CVE-2014-3828: Centreon web SQL injection in multiple PHP endpoints

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: high.

critical priorityCVSS 2.0 score of 10 with network reachability, no authentication and complete confidentiality, integrity and availability impact, plus public exploit references and very high EPSS.

What it is

Centreon 2.5.1 and Centreon Enterprise Server 2.2 contain multiple SQL injection flaws in web scripts such as makeXML_ListMetrics.php, GetXmlTree.php, displayServiceStatus.php, GetXMLTrapsForVendor.php and cmdGetExample.php. Unsanitized parameters (index_id, sid, session_id, mnftr_id, index) are passed into SQL queries, allowing arbitrary SQL execution. The issue is fixed in Centreon web 2.5.3.

Impact

An unauthenticated remote attacker can execute arbitrary SQL commands against the Centreon database, potentially reading, modifying or deleting monitoring configuration and data. Depending on database privileges, this can lead to full compromise of the Centreon application data.

Attack surface

Reachable over the network via HTTP requests to the affected PHP scripts, with no authentication required per the CVSS vector (AV:N/AC:L/Au:N). No user interaction is indicated in the description or vector.

Exploitation

Public exploit references exist (Full Disclosure and SecurityFocus entries tagged Exploit), and EPSS is high at 0.727 (99.4th percentile), though the CVE is not listed in CISA KEV.

What to do

• Upgrade Centreon web to 2.5.3 or later, which contains the fix.
• If immediate upgrade is not possible, restrict network access to the Centreon web interface to trusted management networks only.
• Apply the referenced upstream commit or vendor patch to the affected PHP files.
• Review database account privileges used by Centreon and remove unnecessary write or administrative rights.
• Monitor and audit Centreon web logs for suspicious parameter values targeting the listed scripts.

Detection

• Inspect HTTP access logs for requests to makeXML_ListMetrics.php, GetXmlTree.php, displayServiceStatus.php, GetXMLTrapsForVendor.php and cmdGetExample.php with SQL metacharacters in parameters.
• Enable and review database query logging for anomalous SQL from the Centreon web application.
• Use WAF or IDS rules to alert on SQL injection patterns in the index_id, sid, session_id, mnftr_id and index parameters.
• Correlate unexpected changes to Centreon configuration or monitoring data with web requests to the affected endpoints.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.