Nagios XI < 2012R2.4 SQL Injection Vulnerability

High Nessus Network Monitor Plugin ID 8369


A vulnerable version of Nagios XI has been detected.


Versions of Nagios XI prior to 2012R2.4 are affected by an SQL injection vulnerability in the Nagios Core Configuration Manager. The Nagios Core Configuration Manager is a web-based configuration tool for Nagios XI and is based on the NagiosQL configuration tool. The vulnerability exists in the 'functions/prepend_adm.php' script, which fails to properly sanitize user-supplied input to the 'tfPassword' parameter before using it in database queries. An attacker could execute arbitrary SQL commands leading to manipulation or disclosure of arbitrary data.


Upgrade to Nagios XI 2012R2.4 or later.

See Also

Plugin Details

Severity: High

ID: 8369

File Name: 8369.prm

Family: CGI

Published: 2014/08/26

Modified: 2017/05/31

Dependencies: 3558

Nessus ID: 71636

Risk Information

Risk Factor: High


Base Score: 7.5

Temporal Score: 6.5

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P

Temporal Vector: CVSS2#E:ND/RL:OF/RC:C


Base Score: 7.3

Temporal Score: 7


Temporal Vector: CVSS3#E:X/RL:O/RC:C

Vulnerability Information

CPE: cpe:/a:nagios:nagios_xi

Patch Publication Date: 2013/09/24

Vulnerability Publication Date: 2013/11/13

Reference Information

CVE: CVE-2013-6875

BID: 63754

OSVDB: 99942