CVE-2024-5725: Centreon Web initCurveList SQL Injection Leads to Remote Code Execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 20 September 2026. Confidence: high.

high priorityCVSS 8.8 and high EPSS percentile indicate a serious, likely exploitable flaw, though it requires authentication and no KEV listing or known ransomware use is present.

What it is

Centreon Web contains a SQL injection flaw in the initCurveList function, where a user-supplied string is used to build SQL queries without proper validation. Because the injection point allows query manipulation that can lead to code execution, an authenticated attacker can run arbitrary code as the apache user on the affected installation.

Impact

An attacker with valid credentials can execute arbitrary code in the context of the apache user, giving them control over the Centreon web application and its data. This can lead to full compromise of the monitoring platform and any systems it manages.

Attack surface

The vulnerability is reachable over the network through the Centreon web interface, as indicated by the CVSS vector AV:N. Exploitation requires authentication (PR:L) but no user interaction (UI:N).

Exploitation

The vulnerability is not listed in CISA KEV, but EPSS indicates a high probability of exploitation activity (0.47368, 98.8th percentile). The ZDI advisory and vendor patch reference confirm the flaw is known and fixed, though no public exploit details are provided in the record.

What to do

• Apply the vendor patch referenced in the Centreon security bulletin for Centreon Web.
• Restrict access to the Centreon web interface to trusted networks or VPNs.
• Enforce least privilege for Centreon user accounts and review accounts with access to the affected functionality.
• Monitor and audit SQL queries and application logs for signs of injection attempts.
• If patching is delayed, consider virtual patching or WAF rules targeting SQL injection patterns in Centreon requests.

Detection

• Monitor web server and application logs for unusual SQL syntax or error messages originating from Centreon endpoints.
• Alert on unexpected outbound connections or process creation from the apache user on Centreon hosts.
• Review Centreon audit logs for authenticated users accessing the initCurveList functionality outside normal patterns.
• Use database query logging to detect anomalous SQL statements that deviate from expected application behavior.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.