CVE-2024-32461: high-severity vulnerability in librenms
LibreNMS vulnerable to time-based SQL injection that leads to database extraction
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
No sign of exploitation. No public exploitation artifact known so far.
LibreNMS contains a SQL injection flaw in its package search feature that allows authorized users to extract sensitive data from the database, including admin credentials, by injecting malicious SQL commands.
A time-based SQL injection vulnerability exists in the POST /search endpoint's package parameter in LibreNMS versions before 24.4.0. An authenticated user with global read privileges can inject arbitrary SQL to extract database contents; the vulnerability requires valid credentials but allows complete database compromise.
In the same product, most dangerous first.