CWE Code: 20
Vulnerability Type: sql_injection
CVSS Score: 7.5
CWE Name:  Improper Input Validation
Summary: an issue was discovered in librenms through 1.47. the scripts that handle the graphing options (html/includes/graphs/common.inc.php and html/includes/graphs/graphs.inc.php) do not sufficiently validate or encode several fields of user supplied input. some parameters are filtered with mysqli_real_escape_string, which is only useful for preventing sql injection attacks; other parameters are unfiltered. this allows an attacker to inject rrdtool syntax with newline characters via the html/graph.php script. rrdtool syntax is quite versatile and an attacker could leverage this to perform a number of attacks, including disclosing directory structure and filenames, file content, denial of service, or writing arbitrary files.
Access Authentication: NONE
Access Complexity: LOW
Access Vector: NETWORK
Impact (C/I/A): PARTIAL/PARTIAL/PARTIAL
Published Date: 2019-09-09
Last Modified Date: 2019-09-10