CVE-2023-40931

published 2023-09-19

CVE-2023-40931: A SQL injection vulnerability in Nagios XI from version 5.11.0 up to and including 5.11.1 allows authenticated attackers to execute arbitrary SQL commands via…

Priority P3 56 medium 6.5 CVSS 3.1

AV N AC L PR L UI N S U C H I N A N

EXPLOIT

A SQL injection vulnerability in Nagios XI from version 5.11.0 up to and including 5.11.1 allows authenticated attackers to execute arbitrary SQL commands via the ID parameter in the POST request to /nagiosxi/admin/banner_message-ajaxhelper.php

Affected

1 ranges

Vendor	Product	Version range	Fixed in
nagios	nagios_xi	>= 5.11.0 < 5.11.2	5.11.2

Detection & IOCs extracted from sources · hover to see the quote

url /nagiosxi/admin/banner_message-ajaxhelper.php↗

command POST /nagiosxi/admin/banner_message-ajaxhelper.php action=acknowledge_banner_message&id=*

• → Detect SQL injection exploitation attempts against Nagios XI banner_message-ajaxhelper.php by matching HTTP response body for SQL error strings
• → Target endpoint is /nagiosxi/admin/banner_message-ajaxhelper.php via POST with parameters action=acknowledge_banner_message and a manipulated id value; monitor POST requests to this path for anomalous id parameter values
• → Use Shodan, FOFA, or Google to identify exposed Nagios XI instances as potential targets

• · Vulnerability only affects Nagios XI versions 5.11.0 through 5.11.1 (inclusive); exploitation requires prior authentication ↗

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-89