CVE-2020-15876

Name of the Vulnerable Software and Affected Versions LibreNMS version 1.65

Description A remote authenticated attacker with normal privileges can extract all information from the database via a SQL injection. This occurs through the sort parameter in the '/ajax table.php' API endpoint. The issue affects several files within includes/html/table, including address-search.inc.php, alertlog.inc.php, arp-search.inc.php, as-selection.inc.php, bills.inc.php, device mibs.inc.php, device oids.inc.php, edit-ports.inc.php, eventlog.inc.php, inventory.inc.php, ix-list.inc.php, ix-peers.inc.php, mempool-edit.inc.php, mempool.inc.php, mibs.inc.php, poll-log.inc.php, processor-edit.inc.php, processor.inc.php, routing-edit.inc.php, sensors-common.inc.php, storage-edit.inc.php, storage.inc.php, tnmsneinfo.inc.php, and toner.inc.php.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.