Spawnzii

The software contains an Improper Neutralization of Input During Web Page Generation issue, specifically a Stored Cross-site Scripting (XSS) condition. This allows users with elevated privileges to inject malicious scripts. The issue is located within the Services Meta-services modules.

A flaw exists in Centreon Infra Monitoring related to improper input neutralization during web page generation, leading to a Stored Cross-site Scripting (XSS) condition. This issue is present in the HTTP Loader widget modules. Successful exploitation could allow an attacker to inject malicious scripts into web pages viewed by other users.

Name of the Vulnerable Software and Affected Versions: web versions 23.10.0 through 23.10.26 web versions 24.04.0 through 24.04.16 web versions 24.10.0 through 24.10.9 Description: A user with high privileges can inject SQL commands through the Meta Service indicator page due to improper neutralization of special elements within an SQL query. Recommendations: Update web to a version after 23.10.26. Update web to a version after 24.04.16. Update web to a version after 24.10.9.

Name of the Vulnerable Software and Affected Versions: Centreon web versions 23.10.0 through 23.10.26 Centreon web versions 24.04.0 through 24.04.16 Centreon web versions 24.10.0 through 24.10.9 Description: The web application is susceptible to SQL Injection due to improper neutralization of special elements used in an SQL command within the Monitoring event logs module. An authenticated, low-privileged attacker can manipulate the database by altering HTTP requests to insert a payload. Recommendations: Centreon web versions prior to 23.10.26 should be updated. Centreon web versions prior to 24.04.16 should be updated. Centreon web versions prior to 24.10.9 should be updated.

A user with high privileges is able to achieve SQL injection in the form to upload media. This issue allows attackers with high privileges to exploit the media upload form by potentially injecting malicious SQL code.

A user with high privileges is able to inject SQL into the form used to create virtual metrics. This issue allows an attacker with high privileges to perform SQL injection, potentially enabling privilege escalation.

The issue arises when a user visits a malicious document and clicks on a link in a HyperLink cell using a control modifier, such as Ctrl+click. This could lead to account compromise, as the link could use the javascript: scheme and be evaluated in the context of their current page.

A user visiting a malicious document or submitting a malicious form could have their account compromised due to the ability to use the `javascript:` scheme with custom widget URLs and form redirect URLs.

The issue allows remote authenticated users to execute arbitrary code via the ` oups` parameter. This enables attackers to perform remote code execution (RCE) on affected systems.