Introduction
An attacker with basic user credentials can exploit a SQL injection flaw in Centreon's event logs module to tamper with monitoring data. The flaw lets the attacker insert malicious payloads into the database, which can lead to unauthorized access to, or manipulation of, data across monitored systems.
Centreon is a widely used IT monitoring platform. Enterprises and service providers deploy it to track the health and status of critical infrastructure, and its open-source and commercial products are popular for their flexibility and integrations. Centreon also has a history of notable security issues, so its users need to patch promptly and follow security best practices.
Technical Information
CVE-2025-6791 is a second-order SQL injection vulnerability in the monitoring event logs page of Centreon Web. It falls under CWE-89, improper neutralization of special elements used in SQL commands. An attacker alters HTTP requests to insert crafted payloads into the database. The payloads do not execute right away. They are stored, and vulnerable SQL queries in the event logs module process them later. When the application retrieves and processes that data, the malicious SQL runs and can expose or alter sensitive monitoring information.
Key technical points:
- Exploitation requires authenticated access but not elevated privileges.
- The attacker submits crafted input to the event logs page through HTTP requests.
- The injected payload is stored in the database and executes during later operations, which is what makes this a second-order injection.
- The root cause is insufficient input sanitization and a lack of parameterized queries in the affected module.
No vulnerable code snippets are publicly available at the time of writing. Attack complexity is low, and any authenticated user with access to the monitoring event logs interface can exploit the flaw.
Affected Systems and Versions
- Centreon Web 24.10.0 before 24.10.9
- Centreon Web 24.04.0 before 24.04.16
- Centreon Web 23.10.0 before 23.10.26
Any deployment running a version within these ranges is vulnerable if authenticated users can access the monitoring event logs module.
Vendor Security History
Centreon has had multiple critical vulnerabilities in recent years, including:
- CVE-2024-23119: SQL injection in insertGraphTemplate function (CVSS 8.8)
- CVE-2020-10945: Session identifier exposure and cross-site scripting
- Other SQL injection and authentication bypass issues across various modules
The vendor usually responds with coordinated disclosure and timely patches, but similar flaws keep recurring, which points to persistent weaknesses in input validation and secure development practices.
