Centreon Web SQL Injection Vulnerability in Media Upload Feature

A SQL injection vulnerability has been identified in Centreon Web versions 24.10.x prior to 24.10.3, 24.04.x prior to 24.04.9, 23.10.x prior to 23.10.19, and 23.04.x prior to 23.04.24. This vulnerability allows high-privilege users to inject malicious SQL through the media upload form, potentially leading to unauthorized data manipulation or access.

Impact

Exploitation of this vulnerability allows for SQL injection, where an attacker can manipulate database queries. This could lead to unauthorized data access, data manipulation, or in some cases, executing administrative operations on the database.

Remediation

Users are advised to update to Centreon Web versions 24.10.3, 24.04.9, 23.10.19, or 23.04.24, all of which include cumulative fixes from prior updates.