Vulnerability record · CVE-2016-8582 · published 28 October 2016
CVE-2016-8582: AlienVault OSSIM/USM gauge.php SQL injection enables arbitrary query execution
Alienvault · Open Source Security Information And Event Management
AlienVault OSSIM and USM before 5.3.2 contain a SQL injection flaw in gauge.php that lets an attacker run arbitrary SQL queries against the backend database. Because the injected queries can also use MySQL's LOAD_FILE, the same flaw can be used to read local system files, exposing sensitive data on the appliance.
Description
A vulnerability exists in gauge.php of AlienVault OSSIM and USM before 5.3.2 that allows an attacker to execute an arbitrary SQL query and retrieve database information or read local system files via MySQL's LOAD_FILE.
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Automated analysis
critical priorityCVSS 9.8 with network reachability, no authentication, no user interaction, and a public exploit plus very high EPSS make this a top remediation priority.
What it is
AlienVault OSSIM and USM before 5.3.2 contain a SQL injection flaw in gauge.php that lets an attacker run arbitrary SQL queries against the backend database. Because the injected queries can also use MySQL's LOAD_FILE, the same flaw can be used to read local system files, exposing sensitive data on the appliance.
Impact
An unauthenticated attacker can read arbitrary database contents and local files from the server, which may include credentials, configuration and other sensitive data. The CVSS 3.0 vector rates confidentiality, integrity and availability impact as high.
Attack surface
The flaw is reachable over the network through gauge.php with no authentication and no user interaction required, per the CVSS vector AV:N/AC:L/PR:N/UI:N. Any host that can reach the affected web interface can attempt the injection.
Exploitation
No CISA KEV listing is present, but a public Exploit-DB entry (40684) exists and EPSS is 0.57425 (99th percentile), indicating a high likelihood of exploitation activity.
What to do
- Upgrade AlienVault OSSIM/USM to 5.3.2 or later, which the vendor advisory states addresses this issue.
- Restrict network access to the OSSIM/USM web interface to trusted management networks only.
- Apply input validation and parameterized queries to gauge.php if a patch cannot be deployed immediately.
- Review database and file system permissions for the web application account to limit what LOAD_FILE can read.
- Monitor for and block SQL injection patterns targeting gauge.php at the web tier.
Detection
- Inspect web server and application logs for requests to gauge.php containing SQL syntax, UNION, or LOAD_FILE strings.
- Alert on database queries originating from the web application that reference information_schema or file-reading functions.
- Monitor for unexpected outbound or file access activity from the OSSIM/USM host consistent with data exfiltration.
- Use the public Exploit-DB PoC (40684) to build signatures for known injection payloads against gauge.php.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
2 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
Track CVE-2016-8582 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2016-8582), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
