CVE-2014-3828

Multiple SQL injection vulnerabilities in Centreon 2.5.1 and Centreon Enterprise Server 2.2 (fixed in Centreon web 2.5.3) allow remote attackers to execute arbitrary SQL commands via (1) the index_id parameter to views/graphs/common/makeXML_ListMetrics.php, (2) the sid parameter to views/graphs/GetXmlTree.php, (3) the session_id parameter to views/graphs/graphStatus/displayServiceStatus.php, (4) the mnftr_id parameter to configuration/configObject/traps/GetXMLTrapsForVendor.php, or (5) the index parameter to common/javascript/commandGetArgs/cmdGetExample.php in include/.

• CWE-89

• http://seclists.org/fulldisclosure/2014/Oct/78Exploit
• http://www.kb.cert.org/vuls/id/298796Third Party Advisory, US Government Resource
• http://www.securityfocus.com/bid/70648Exploit
• https://documentation.centreon.com/docs/centreon/en/latest/release_notes/centreon-2.5/centreon-2.5.3.html
• https://github.com/centreon/centreon/commit/cc2109804dd69057cb209037113796ec5ffdce90#diff-e328097503b14fbb117e0db798aefcde
• http://seclists.org/fulldisclosure/2014/Oct/78Exploit
• http://www.kb.cert.org/vuls/id/298796Third Party Advisory, US Government Resource
• http://www.securityfocus.com/bid/70648Exploit
• https://documentation.centreon.com/docs/centreon/en/latest/release_notes/centreon-2.5/centreon-2.5.3.html
• https://github.com/centreon/centreon/commit/cc2109804dd69057cb209037113796ec5ffdce90#diff-e328097503b14fbb117e0db798aefcde

Published

Oct 23, 2014

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2014-3822Juniper Junos 11.4 before 11.4R8, 12.1 before 12.1R5, 12.1X4…
• CVE-2014-3823The Juniper Junos Pulse Secure Access Service (SSL VPN) devi…
• CVE-2014-3824Cross-site scripting (XSS) vulnerability in the web server i…
• CVE-2014-3825The Juniper SRX Series devices with Junos 11.4 before 11.4R1…
• CVE-2014-3826Cross-site scripting (XSS) vulnerability in MyBB before 1.6.…5.4
• CVE-2014-3827Multiple cross-site scripting (XSS) vulnerabilities in the M…5.4
• CVE-2014-3829displayServiceStatus.php in Centreon 2.5.1 and Centreon Ente…
• CVE-2014-3830Cross-site scripting (XSS) vulnerability in info.php in Toma…
• CVE-2014-3831Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultI…
• CVE-2014-3832Cross-site scripting (XSS) vulnerability in the Documents co…
• CVE-2014-3833Multiple cross-site scripting (XSS) vulnerabilities in the (…
• CVE-2014-3834ownCloud Server before 6.0.3 does not properly check permiss…