CWE Code: 94
Vulnerability Type: sql_injection
CVSS Score: 6.5
CWE Name:  Improper Control of Generation of Code ('Code Injection')
Summary: an issue was discovered in librenms 1.50.1. the scripts that handle graphing options (includes/html/graphs/common.inc.php and includes/html/graphs/graphs.inc.php) do not sufficiently validate or encode several fields of user supplied input. some parameters are filtered with mysqli_real_escape_string, which is only useful for preventing sql injection attacks; other parameters are unfiltered. this allows an attacker to inject rrdtool syntax with newline characters via the html/graph.php and html/graph-realtime.php scripts. rrdtool syntax is quite versatile and an attacker could leverage this to perform a number of attacks, including disclosing directory structure and filenames, disclosing file content, denial of service, or writing arbitrary files. note: relative to cve-2019-10665, this requires authentication and the pathnames differ.
Access Authentication: SINGLE
Access Complexity: LOW
Access Vector: NETWORK
Impact (C/I/A): PARTIAL/PARTIAL/PARTIAL
Published Date: 2019-09-09
Last Modified Date: 2019-09-10