CVE-2025-6791 - Second order SQL injection available to user with low privilege

Back Back to CVE browser

HIGH

Second order SQL injection available to user with low privilege

Published Aug 22, 2025

8.8

HIGH

CVSS 3.1

EPSS 0.34%

Description

In the monitoring event logs page, it is possible to alter the http request to insert a reflect payload in the DB. Caused by an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Centreon web (Monitoring event logs modules) allows SQL Injection.This issue affects web: 24.10.0, 24.04.0, 23.10.0.

Affected products

Vendor Centreon Product Web Default
unaffected
- Version
  23.10.0
  Status
  affected
  Constraints
  <23.10.26
- Version
  24.04.0
  Status
  affected
  Constraints
  <24.04.16
- Version
  24.10.0
  Status
  affected
  Constraints
  <24.10.9

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Centreon

Web

unaffected

Version	Status	Constraints
23.10.0	affected	<23.10.26
24.04.0	affected	<24.04.16
24.10.0	affected	<24.10.9

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-89

SQL Injection

References (3)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-25618
Advisory
https://github.com/centreon/centreon/releases
release-notesRelease Notes
https://thewatch.centreon.com/latest-security-bulletins-64/cve-2025-6791-centreon-web-all-versions-high-severity-4900
vendor-advisoryVendor Advisory

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-25618		Advisory
https://github.com/centreon/centreon/releases		release-notesRelease Notes
https://thewatch.centreon.com/latest-security-bulletins-64/cve-2025-6791-centreon-web-all-versions-high-severity-4900		vendor-advisoryVendor Advisory