Critical · published October 31, 2025
⚡ A crafty SQL injection lurking in Nagios XI’s Core Configuration Manager could let authenticated users play puppet master with your database! 😲 Think of this vulnerability like a restaurant manager who allows their staff to change menu items without checking their credentials — it could lead to unauthorized dishes that ruin the dining experience for everyone! Exploitation of this vulnerability could lead to the disclosure or modification of critical configuration data, giving attackers the potential to wreak havoc on your monitoring setup. In some cases, they might even have broader access to the application database, which could be absolutely devastating for your operations!
Think of this vulnerability like a restaurant manager who allows their staff to change menu items without checking their credentials — it could lead to unauthorized dishes that ruin the dining experience for everyone! This SQL injection flaw allows authenticated users to manipulate SQL queries by injecting crafted input into specific parameters within the Core Configuration Manager (CCM) interface of Nagios XI versions prior to 2012R1.3.
Exploitation of this vulnerability could lead to the disclosure or modification of critical configuration data, giving attackers the potential to wreak havoc on your monitoring setup. In some cases, they might even have broader access to the application database, which could be absolutely devastating for your operations! Upgrade your Nagios XI to version 2012R1.3 or later immediately to patch this vulnerability. Additionally, consider auditing user permissions and input validation within the CCM to prevent unauthorized access in the future. You've got this! Follow these steps and you'll reinforce your defenses in no time. 🛡️
| Product | Versions | Fixed in |
|---|---|---|
| nagios/nagios_xi | ≤ 2011 | — |
| nagios/nagios_xi | all versions | — |
| nagios/nagios_xi | all versions | — |
| nagios/nagios_xi | all versions | — |