Lucene search
PRIOn knowledge basePRION:CVE-2015-1561HistoryJul 14, 2015 - 4:59 p.m.
Code injection
2015-07-1416:59:00
PRIOn knowledge base
www.prio-n.com
7
The escape_command function in include/Administration/corePerformance/getStats.php in Centreon (formerly Merethis Centreon) 2.5.4 and earlier (fixed in Centreon 19.10.0) uses an incorrect regular expression, which allows remote authenticated users to execute arbitrary commands via shell metacharacters in the ns_id parameter.
References
packetstormsecurity.com/files/132607/Merethis-Centreon-2.5.4-SQL-Injection-Remote-Command-Execution.html
www.securityfocus.com/archive/1/535961/100/0/threaded
forge.centreon.com/projects/centreon/repository/revisions/387dffdd051dbc7a234e1138a9d06f3089bb55bb
github.com/centreon/centreon/commit/a78c60aad6fd5af9b51a6d5de5d65560ea37a98a
Related
cve
cve
CVE-2015-1561
2015-07-14 16:59:01
nvd
nvd
CVE-2015-1561
2015-07-14 16:59:01
github
github
Centreon Command Injection
2022-05-14 00:55:18
osv
osv
Centreon Command Injection
2022-05-14 00:55:18
cvelist
cvelist
CVE-2015-1561
2015-07-14 16:00:00
exploitpack
exploitpack
Centreon 2.5.4 - Multiple Vulnerabilities
2015-07-08 00:00:00
zdt
zdt
Centreon 2.5.4 - Multiple Vulnerabilities
2015-07-08 00:00:00
packetstorm
packetstorm
Merethis Centreon 2.5.4 SQL Injection / Remote Command Execution
2015-07-08 00:00:00
securityvulns
securityvulns
openvas
openvas
Centreon Multiple Vulnerabilities (Sep 2015)
2015-09-08 00:00:00
exploitdb
exploitdb
Centreon 2.5.4 - Multiple Vulnerabilities
2015-07-08 00:00:00