Centreon Web SQL Injection Vulnerability Allowing Privileged User Escalation

A SQL injection vulnerability has been identified in Centreon Web, specifically in the user configuration form modules. This issue affects Centreon versions 22.10.0 prior to 22.10.28, 23.04.0 prior to 23.04.25, 23.10.0 prior to 23.10.20, 24.04.0 prior to 24.04.10, and 24.10.0 prior to 24.10.4. The vulnerability allows a user with high privileges to intercept contact form requests and modify the payload, potentially leading to unauthorized administrative access.

Impact

Exploitation of this vulnerability could allow a high-privileged user to gain administrative rights on the Centreon Web application.

Remediation

Users are advised to update to Centreon Web versions 24.10.4, 24.04.10, 23.10.20, or 23.04.25, all of which include cumulative fixes from prior updates.