CVE-2024-23117

Deeper analysis

Centreon contains a SQL injection vulnerability in the updateContactServiceCommands function that permits remote code execution on affected installations. The flaw stems from insufficient validation of user-supplied input before it is incorporated into SQL queries, enabling an authenticated attacker to execute arbitrary code in the context of the service account. The issue was originally reported as ZDI-CAN-22297 and carries a CVSS 3.0 score of 7.2.

An attacker with a valid administrative account can supply a crafted string over the network to trigger the injection and obtain code execution without user interaction. The vulnerability affects the web interface component responsible for contact and service command management within Centreon.

The associated Zero Day Initiative advisory notes the existence of the flaw but does not detail specific patches or workarounds in the supplied references. The EPSS score has remained at 0.8739 without an observable rise from a lower baseline.