Do I have to patch some files manually?
GET /nagiosql/admin/commandline.php?cname='%20union%20select%20concat(0x7e7e7e;user();0x7e7e7e)%23 HTTP/1.1
Host: xxx
Connection: Keep-Alive
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:61.0) Gecko/20100101 Firefox/61.0
Nagios XI SQL Injection vulnerability detected on port: 443
<!DOCTYPE HTML PUBLIC -//W3C//DTD HTML 4.01 Transitional//EN>
<html>
<head>
<title>Commandline</title>
<meta http-equiv=Content-Type content=text/html; charset=utf-8>
<style type=text/css>
<!--
body {
font-family: Verdana; Arial; Helvetica; sans-serif;
font-size: 12px;
color: 000000;
/*background-color: EDF5FF;*/
margin: 3px;
border: none;
}
-->
</style>
</head>
<body>
~~~nagiosql@localhost~~~ <script type=text/javascript language=javascript>
<!--
parent.argcount = 0;
//-->
</script>
</body>
</html>-CR-
---------- ---------- ----------
Port: 443/tcp
Layer: Application
References: Qualys Knowledgebase:
https://ipinsplus.siemens.com/pub/QIDsearch?id=011992
Bugtraq List:
104189, http://www.securityfocus.com/bid/104189
Generic Remediation Instructions: Update to Nagios XI 5.4.13 or above from here
Patch:
Following are links for downloading patches to fix the vulnerabilities:
Nagios XI
Generic Vulnerability Description:
Powerful Monitoring Engine Nagios XI uses the powerful Nagios Core 4 monitoring engine to provide users with efficient, scalable monitoring.
Updated Web Interface Your new dashboard provides a customization high-level overview of hosts, services, and network devices.
CVE-2018-10738 - menuaccess.php SQL injection
CVE-2018-10737 - logbook.php SQL injection
CVE-2018-10736 - info.php SQL injection
CVE-2018-10735 - commandline.php SQL injection
Affected Versions:
Nagios XI 5.2.x
Nagios XI 5.4.x before 5.4.13
QID Detection logic:(Unauthenticated)
It tries to perform SQL Injection to check for vulnerable versions of Nagios XI
Consequences:
Successful SQL Injection by an attacker can result in exposure of sensitive information.