CVE-2015-1560-1561

CVE-2015-1560, CVE-2015-1561
Centreon Web Time-Based Blind SQLi to RCE

Centreo(w)n! 💥

Description

CVE-2015-1560

An unauthenticated SQL injection vulnerability in the "isUserAdmin" function defined in "include/common/common-Func.php" in Centreon Web 2.5.4 and earlier, allows remote attackers to execute arbitrary SQL command(s) via the "sid" parameter defined in "include/common/XmlTree/GetXmlTree.php". Work only if NDOUtils is installed and acts as Centreon Web's broker.

CVE-2015-1561

A command injection vulnerability in the "escape_command" function defined in "include/Administration/corePerformance/getStats.php" in Centreon Web 2.5.4 and earlier uses an incorrect regular expression, which allows remote authenticated users to execute arbitrary commands via shell metacharacters in the "ns_id" parameter.

Limitation

This exploit works as long as there is a valid "session_id" registered in the "centreon.session" table.

Author

• iojymbo (@iojymbo)

Credit

• Huy-Ngoc DAU (@ngocdh) - Deloitte Conseil

Affected Products

• Centreon Web 2.5.4 and earlier

Advisories

• CVE-2015-1560
• CVE-2015-1561

Reference

• Packet Storm - Merethis Centreon 2.5.4 SQL Injection / Remote Command Execution

Date of public disclosure

July 8th, 2015

Google Dork

intitle:"Centreon - IT & Network Monitoring" intext:"2004|2005-2008|2009|2010|2011|2012|2013|2014"

Usage

Without "session_id"

$ python CVE-2015-1560-1561.py -r <RHOST> -p <RPORT> -u <URI> -c <CMD> [-s / -ssl]
$ python CVE-2015-1560-1561.py -r 192.168.0.3 -p 80 -u /centreon/ -c "uname -a;id;pwd"

With "session_id"

$ python CVE-2015-1560-1561.py -r <RHOST> -p <RPORT> -u <URI> -c <CMD> -i <SESSION_ID> [-s / -ssl]
$ python CVE-2015-1560-1561.py -r 192.168.0.3 -p 80 -u /centreon/ -c "sudo -l" -i a2hlspgh62nd5cuvvpdhmm9r60

Tested against

• Centreon Web 2.5.4
• Centreon Web 2.5.3

Solution

Upgrade Centreon Web.

License

Usage is provided under the WTFPL license.
See LICENSE for the full details.