CVE-2024-33854

A SQL Injection vulnerability exists in the Graph Template component in Centreon Web 24.04.x before 24.04.3, 23.10.x before 23.10.13, 23.04.x before 23.04.19…

Critical · published August 23, 2024

CVSS v3.1
9.1
EPSS
0%
Percentile
41.1
In the wild
Unconfirmed
What it is

🚨 A sneaky SQL injection in Centreon's Graph Template component can let attackers manipulate your database with just the right crafted input! Think of it like a restaurant where a customer can sneak in a note to the chef, saying to swap out the ingredients of their dish without anyone noticing. This vulnerability allows a malicious user to modify your database queries while bypassing the regular checks. An attacker could execute arbitrary SQL commands, leading to devastating consequences like data theft, data manipulation, or even complete system takeover. Imagine losing access to critical information or having sensitive data exposed to the wrong hands – absolutely terrifying!

Put simply

Think of it like a restaurant where a customer can sneak in a note to the chef, saying to swap out the ingredients of their dish without anyone noticing. This vulnerability allows a malicious user to modify your database queries while bypassing the regular checks. This SQL injection vulnerability allows attackers to inject harmful SQL code via the Graph Template component in Centreon, affecting multiple versions including 24.04.x, 23.10.x, and more. The flawed input validation means that attackers can alter database queries without proper permissions.

What to do

An attacker could execute arbitrary SQL commands, leading to devastating consequences like data theft, data manipulation, or even complete system takeover. Imagine losing access to critical information or having sensitive data exposed to the wrong hands – absolutely terrifying! Update Centreon immediately to version 24.04.3, 23.10.13, 23.04.19, or 22.10.23 to close this vulnerability. Regularly audit your database queries and input validation methods to prevent similar exploits in the future. You've got this! By taking these steps, you’re a security hero protecting your data and keeping your systems safe! 🛡️

The record
Technical detail
CVSS v3.1
9.1 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00488 · 41.1th percentile
Published
2024-08-23T00:00Z
EPSS history
Timeline
  • 23 AUG 00:00Z
    A SQL Injection vulnerability exists in the Graph Template component in Centreon Web 24.04.x before 24.04.3, 23.10.x before 23.10.13, 23.04.x before 23.04.19…
    cvelistv5