Detections
Analytics

CVE-2018-8734

critical

Description

SQL injection vulnerability in the core config manager in Nagios XI 5.2.x through 5.4.x before 5.4.13 allows an attacker to execute arbitrary SQL commands via the selInfoKey1 parameter.

References

https://gist.github.com/caleBot/f0a93b5a98574393e0139104eacc2d0f

https://www.exploit-db.com/exploits/44969/

https://www.exploit-db.com/exploits/44560/

https://www.nagios.com/downloads/nagios-xi/change-log/

https://blog.redactedsec.net/exploits/2018/04/26/nagios.html

https://assets.nagios.com/downloads/nagiosxi/CHANGES-5.TXT

Details

Source: Mitre, NVD

Published: 2018-04-18

Updated: 2026-06-17

Risk Information

CVSS v2

Base Score: 7.5

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P

Severity: High

CVSS v3

Base Score: 9.8

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Severity: Critical

EPSS

EPSS: 0.53247