Description
An issue was discovered in LibreNMS 1.65. A remote authenticated attacker with normal privileges can extract all the information from the LibreNMS database via a SQL injection in the searchPhrase parameter in the /ajax_table.php API endpoint. This affects as-selection.inc.php, edit-ports.inc.php, alertlog-stats.inc.php, alerts.inc.php, eventlog.inc.php, inventory.inc.php, ix-list.inc.php, ix-peers.inc.php, mempool-edit.inc.php, mempool.inc.php, poll-log.inc.php, processor-edit.inc.php, processor.inc.php, routing-edit.inc.php, sensors-common.inc.php, storage-edit.inc.php, storage.inc.php, and toner.inc.php (in includes/html/table). NOTE: some sources refer to this as CVE-2020-15876, but CVE-2020-15875 is the only correct CVE ID.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
LibreNMS LibreNMS
Default version status: unaffected
0 to < 1.65.1affected
References
- https://community.librenms.org/c/announcements ↗
- https://github.com/librenms/librenms/compare/1.65...1.65.1 ↗
- https://github.com/librenms/librenms/releases/tag/1.65.1 ↗
- https://shielder.it/blog ↗
- https://www.shielder.com/advisories/librenms-searchphrase-authenticated-sql-injection/ ↗
- https://github.com/librenms/librenms/commit/32f72bc1ab7e980e4070e826a89d0d36a5ba62dd ↗