Centreon Web SQL Injection Vulnerability in Virtual Metrics Creation

A SQL injection vulnerability has been identified in Centreon Web versions 24.10.x prior to 24.10.3, 24.04.x prior to 24.04.9, 23.10.x prior to 23.10.19, and 23.04.x prior to 23.04.24. This issue allows high-privilege users to inject malicious SQL into the form used for creating virtual metrics.

Impact

Exploitation of this vulnerability allows for SQL injection, where an authenticated user with high privileges can manipulate SQL queries. This could potentially lead to unauthorized data access or modification, depending on the application's database handling.

Remediation

Users are advised to update to Centreon Web versions 24.10.3, 24.04.9, 23.10.19, or 23.04.24, all of which include cumulative fixes from prior updates.