0cd38b15b8
5 changes to exploits/shellcodes macOS/iOS ImageIO - Heap Corruption when Processing Malformed TIFF Image Pachev FTP Server 1.0 - Path Traversal ManageEngine Network Configuration Manager 12.2 - 'apiKey' SQL Injection Webtareas 2.0 - 'id' SQL Injection OLK Web Store 2020 - Cross-Site Request Forgery Webtareas 2.0 - 'id' SQL Injection OLK Web Store 2020 - Cross-Site Request Forgery Adive Framework 2.0.8 - Cross-Site Request Forgery (Change Admin Password) Octeth Oempro 4.8 - 'CampaignID' SQL Injection Centreon 19.10.5 - Database Credentials Disclosure Centreon 19.10.5 - Remote Command Execution
42 lines
No EOL
1.3 KiB
Text
42 lines
No EOL
1.3 KiB
Text
# Exploit Title: Centreon 19.10.5 - Database Credentials Disclosure
|
|
# Date: 2020-01-27
|
|
# Exploit Author: Fabien AUNAY, Omri Baso
|
|
# Vendor Homepage: https://www.centreon.com/
|
|
# Software Link: https://github.com/centreon/centreon
|
|
# Version: 19.10.5
|
|
# Tested on: CentOS 7
|
|
# CVE : -
|
|
|
|
###########################################################################################################
|
|
Centreon 19.10.5 Database Credentials Disclosure
|
|
|
|
Trusted by SMBs and Fortune 500 companies worldwide.
|
|
An industry reference in IT Infrastructure monitoring for the enterprise.
|
|
Counts 200,000+ ITOM users worldwide and an international community of software collaborators.
|
|
Presence in Toronto and Luxembourg.
|
|
Deployed in diverse sectors:
|
|
- IT & telecommunication
|
|
- Transportation
|
|
- Government
|
|
- Heath care
|
|
- Retail
|
|
- Utilities
|
|
- Finance & Insurance
|
|
- Aerospace & Defense
|
|
- Manufacturing
|
|
- etc.
|
|
|
|
###########################################################################################################
|
|
|
|
POC:
|
|
|
|
- Configuration / Pollers / Broker configuration
|
|
-- Central-broker | Central-broker-master
|
|
--- Output
|
|
|
|
It is possible to discover the unencrypted password with the inspector.
|
|
|
|
|
|
DB user centreon
|
|
DB password ********
|
|
<input size="120" name="output[0][db_password]" type="password" value="ZVy892xx"> |