LibreNMS is vulnerable to SQL Injection (Boolean-Based Blind) in hostname parameter in ajax_output.php endpoint

LibreNMS has a SQL injection flaw in its ajax_output.php endpoint where the hostname parameter is not properly cleaned before being used in database queries. An attacker can exploit this to extract sensitive information from the database by sending specially crafted requests and observing the application's responses.

A boolean-based blind SQL injection vulnerability exists in the hostname parameter of the /ajax_output.php endpoint in LibreNMS versions prior to 25.11.0, where unsanitized user input is directly concatenated into SQL queries without prepared statements. An unauthenticated attacker can craft malicious HTTP requests to infer database contents through time-based or conditional response analysis, potentially exposing sensitive monitoring data and system credentials.