Nagios XI Unspecified Command Injection Vulnerability

http://www.securityfocus.com/bid/54263

Security Info

Bugtraq ID:	54263
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Jul 02 2012 12:00AM
Updated:	Jul 03 2012 01:50PM
Credit:	Daniel Compton of NCC Group
Vulnerable:

Not Vulnerable:

Security Discussion

Nagios XI is prone to a command-injection vulnerability because it fails to adequately sanitize user-supplied input.

Attackers can exploit this issue to execute arbitrary commands in the context of the web server process. Successful exploits could compromise the application and possibly the underlying system.

Proof of Concept and Security Exploits

An attacker can exploit the issue through a browser.

Security Solution(s)

Solution:
Updates are available. Please see the references for more information.

Security References(s)

References:

Nagios XI Homepage (Nagios)

Emagined Security Blog featuring Dr. Eugene Schultz

Secure Web Programming
by Vizual Services