23 lines
822 B
YAML
23 lines
822 B
YAML
id: CVE-2021-25298
|
|
|
|
info:
|
|
name: Nagios XI 5.7.5 Command Injection
|
|
author: k0pak4
|
|
severity: critical
|
|
description: Nagios XI 5.7.5 is affected by OS command injection. An authenticated user can gain code execution with a single HTTP request due to unsanitized URL paramaters.
|
|
reference:
|
|
- https://nvd.nist.gov/vuln/detail/CVE-2021-25298
|
|
- https://github.com/fs0c-sh/nagios-xi-5.7.5-bugs/blob/main/README.md
|
|
- https://github.com/rapid7/metasploit-framework/pull/17494
|
|
classification:
|
|
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
|
|
cvss-score: 8.8
|
|
cve-id: CVE-2021-25298
|
|
cwe-id: CWE-78
|
|
tags: cve,cve2021,nagiosxi
|
|
|
|
requests:
|
|
- method: GET
|
|
- path:
|
|
- "{{BaseUrl}}/nagiosxi/config/monitoringwizard.php?update=1&ipaddress=127.0.0.1&nextstep=4&wizard=digitalocean"
|