CVE-2018-8734: nagios nagios_xi SQL Injection

CVSS: 9.8v3.0CriticalModified

Published 18-04-2018Last modified 05-08-2024

Vulnerability summary

CVE-2018-8734 is a critical (CVSS 9.8) SQL Injection vulnerability in nagios nagios_xi. EPSS estimates a 53.76% chance of exploitation in the next 30 days, higher than 98.9% of scored vulnerabilities. 5 public exploits are recorded.

Overall risk

70/100

0100

High · default modelHow is this calculated?

CVSS score

9.8/10

010

Critical · v3.0 (NVD)

EPSS score

53.76%

0%100%

Critical · +1.20 pp in 30 days

KEVNot listedIn no KEV catalog

RansomwareNone recordedNo known use recorded

Public exploits5reference, metasploit, exploit-database

Timeline

18-04-2018
PublishedVulnerability first disclosed.
05-08-2024
Last modifiedVulnerability information updated.

Description

SQL injection vulnerability in the core config manager in Nagios XI 5.2.x through 5.4.x before 5.4.13 allows an attacker to execute arbitrary SQL commands via the selInfoKey1 parameter.

CVSS metrics

2 scores · 1 source · 2 versions

v3.09.8v2.07.5

EPSS trend

Probability

53.76%

Chance of exploitation in the next 30 days

Percentile

99%

Versus all other CVEs

30-day change

+1.20 pp

From 52.56% on 22-09-2026

22-09-202622-10-2026

EPSS score

53.76%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

5 found

referenceUnverified
Exploit Reference (blog.redactedsec.net)
Maturity: unknown
MetasploitremoteVerified
Nagios XI Chained Remote Code Execution
exploit/linux/http/nagios_xi_chained_rce
Maturity: weaponized
MetasploitremoteUnverified
Nagios XI Chained Remote Code Execution
exploit/linux/http/nagios_xi_chained_rce_2_electric_boogaloo
Maturity: poc

Show all 5 exploits

exploit-databaseremotelinuxVerified
Nagios XI 5.2.6-5.4.12 - Chained Remote Code Execution (Metasploit)
Maturity: weaponized
exploit-databasephpVerified
Nagios XI 5.2.6 < 5.2.9 / 5.3 / 5.4 - Chained Remote Root
Maturity: poc

Weaknesses

CWE · root cause

CWE-89Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.

Affected systems

Nagios1 product

nagios_xi≥ 5.2.0, < 5.4.13

1 vendor · 1 product

References

6 links

gist.github.com/caleBot/f0a93b5a98574393e0139104eacc2d0fX Refsource MISCThird Party Advisory
www.exploit-db.com/exploits/44560/ExploitX Refsource EXPLOIT DBThird Party AdvisoryVDB Entry
www.nagios.com/downloads/nagios-xi/change-log/X Refsource MISCRelease NotesVendor Advisory
blog.redactedsec.net/exploits/2018/04/26/nagios.htmlX Refsource MISCExploitTechnical DescriptionThird Party Advisory
assets.nagios.com/downloads/nagiosxi/CHANGES-5.TXTX Refsource MISCRelease NotesVendor Advisory
www.exploit-db.com/exploits/44969/ExploitX Refsource EXPLOIT DBThird Party AdvisoryVDB Entry

Vulnerability summary

Timeline

Description

CVSS metrics

EPSS trend

Known exploited

Public exploits

Weaknesses

Affected systems

References

Related vulnerabilities