High · published January 27, 2026
⚡ An authenticated SQL injection lurks in LibreNMS 1.46 that lets attackers fish for sensitive database info — and they just need a cleverly crafted 'sort' parameter! Think of it as a mischievous chef sneaking extra ingredients into a recipe because the head chef accidentally left the pantry door open — without oversight, the entire dish could be spoiled! If exploited, an attacker could extract valuable database information, potentially leading to data leaks and privacy violations. This could result in unauthorized access to sensitive user data, making it a high-risk scenario for any organization using LibreNMS.
Think of it as a mischievous chef sneaking extra ingredients into a recipe because the head chef accidentally left the pantry door open — without oversight, the entire dish could be spoiled! This SQL injection vulnerability arises in the MAC accounting graph endpoint, allowing attackers to manipulate input parameters to execute malicious SQL commands for data extraction through a time-based blind injection.
If exploited, an attacker could extract valuable database information, potentially leading to data leaks and privacy violations. This could result in unauthorized access to sensitive user data, making it a high-risk scenario for any organization using LibreNMS. To safeguard your system, upgrade to LibreNMS version 1.47 or later immediately. Additionally, consider implementing input validation to sanitize parameters, ensuring that only safe data can be processed. Regular audits of database queries can further bolster your defenses. You've got this! With these steps, you can protect your database and keep your systems secure! 🛡️
| Product | Versions | Fixed in |
|---|---|---|
| librenms/librenms | all versions | — |