Vulnerability record · CVE-2024-23115 · published 1 April 2024
CVE-2024-23115: Centreon updateGroups SQL injection leads to remote code execution
Centreon · Centreon Web
CVE-2024-23115 is a SQL injection in the updateGroups function of Centreon web. A user-supplied string is not validated before being used to build SQL queries, and the flaw can be chained to remote code execution. It matters because a compromised Centreon instance gives an attacker a foothold in the monitoring infrastructure.
Description
Centreon updateGroups SQL Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Centreon. Authentication is required to exploit this vulnerability. The specific flaw exists within the updateGroups function. The issue results from the lack of proper validation of a user-supplied string before using it to construct SQL queries. An attacker can leverage this vulnerability to execute code in the context of the service account. Was ZDI-CAN-22295.
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Automated analysis
high priorityCVSS 7.2 with full confidentiality, integrity and availability impact plus a very high EPSS score, though exploitation requires authenticated high privileges.
What it is
CVE-2024-23115 is a SQL injection in the updateGroups function of Centreon web. A user-supplied string is not validated before being used to build SQL queries, and the flaw can be chained to remote code execution. It matters because a compromised Centreon instance gives an attacker a foothold in the monitoring infrastructure.
Impact
An attacker can execute arbitrary code in the context of the service account, gaining control of the Centreon application and its data. This can expose monitored hosts, credentials and configuration managed by the platform.
Attack surface
Reachable over the network via the Centreon web interface, per the CVSS vector AV:N. Authentication is required and the vector shows high privileges (PR:H); no user interaction is needed (UI:N).
Exploitation
Not listed in CISA KEV and no public exploit tag appears in the references, but EPSS is 0.67493 (99.3rd percentile), indicating a high predicted likelihood of exploitation activity.
What to do
- Apply the vendor patch referenced in ZDI-24-117 as soon as possible.
- Restrict access to the Centreon web interface to trusted management networks and administrative users.
- Review and reduce accounts with the privileges needed to reach the updateGroups function.
- Monitor Centreon database and application logs for anomalous SQL or unexpected process execution.
- Keep Centreon and its dependencies current to pick up related fixes.
Detection
- Search web and database logs for SQL syntax, UNION or stacked-query patterns in requests touching updateGroups.
- Alert on unexpected child processes spawned by the Centreon web or database service account.
- Baseline normal updateGroups traffic and flag requests from unusual source IPs or accounts.
- Monitor for new or modified files under the Centreon web root and for outbound connections from the Centreon host.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
| Link | Tags |
|---|---|
| https://www.zerodayinitiative.com/advisories/ZDI-24-117/ | PatchThird Party Advisory |
| https://www.zerodayinitiative.com/advisories/ZDI-24-117/ | PatchThird Party Advisory |
Track CVE-2024-23115 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2024-23115), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.
