Critical · published January 23, 2025
🔥 A user with high privileges can pull off SQL injection through a media upload form in Centreon Web versions 24.10.x, 24.04.x, and 23.04.x — a truly unsettling discovery! Think of it like a restaurant where a chef can sneak in any secret ingredient without anyone checking the recipe — they can completely change the dish without any oversight! This vulnerability could lead to an attacker executing malicious SQL commands, potentially exposing sensitive data or even altering the database itself. Imagine an insider chef serving up surprises that could ruin the entire dinner experience!
Think of it like a restaurant where a chef can sneak in any secret ingredient without anyone checking the recipe — they can completely change the dish without any oversight! In Centreon Web, a high-privileged user can exploit the media upload form to inject harmful SQL code due to improper input validation, allowing unauthorized database manipulation.
This vulnerability could lead to an attacker executing malicious SQL commands, potentially exposing sensitive data or even altering the database itself. Imagine an insider chef serving up surprises that could ruin the entire dinner experience! Immediately upgrade to Centreon Web versions 24.10.3, 24.04.9, 23.10.19, or 23.04.24 to close this serious vulnerability. Additionally, review and validate user permissions to ensure only those who absolutely need high privileges have them! You've got this! Follow these steps and you'll fortify your application against this critical vulnerability! 🛡️