Miggo Logo
Miggo Vulnerability Database
→
CVE-2024-23119

CVE-2024-23119: Centreon insertGraphTemplate SQL Injection Remote Code Execution Vulnerability

8.8

CVSS Score
3.0

Basic Information

CVE ID
CVE-2024-23119
GHSA ID
GHSA-626r-cj47-p49g
EPSS Score
0.96917%
CWE
CWE-89
Published
4/2/2024
Updated
4/2/2024
KEV Status
No
Technology
TechnologyPHP

Technical Details

CVSS Vector
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Package NameEcosystemVulnerable VersionsFirst Patched Version
centreon/centreoncomposer< 22.10.1522.10.15

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

  1. The vulnerability title and description explicitly name insertGraphTemplate as the vulnerable function.
  2. CWE-89 (SQL Injection) aligns with the described lack of input validation before SQL query construction.
  3. While the provided commit diff shows template escaping fixes in listHost.ihtml, this appears to be a secondary hardening measure. The primary vulnerability resides in the backend SQL handling of insertGraphTemplate, as confirmed by:
    • ZDI's advisory explicitly referencing the function
    • CVSS vector showing authentication requirement (PR:L)
    • Vulnerability severity tied to direct SQL query manipulation
  4. The function name follows Centreon's pattern for configuration object handlers (matching the affected component 'graphTemplate').

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

**ntr*on ins*rt*r*p*T*mpl*t* SQL Inj**tion R*mot* *o** *x**ution Vuln*r**ility. T*is vuln*r**ility *llows r*mot* *tt**k*rs to *x**ut* *r*itr*ry *o** on *****t** inst*ll*tions o* **ntr*on. *ut**nti**tion is r*quir** to *xploit t*is vuln*r**ility. T**

Reasoning

*. T** vuln*r**ility titl* *n* **s*ription *xpli*itly n*m* ins*rt*r*p*T*mpl*t* *s t** vuln*r**l* *un*tion. *. *W*-** (SQL Inj**tion) *li*ns wit* t** **s*ri*** l**k o* input v*li**tion ***or* SQL qu*ry *onstru*tion. *. W*il* t** provi*** *ommit *i** s