Description
An SQL injection vulnerability has been discovered within the login functionality of Nagios Core Config Manager. This vulnerability exists due to the password field not being validated before being used to construct an SQL query on-the-fly. SQL Injection allows a malicious entity to execute arbitrary SQL statements. This vulnerability was discovered within the Nagios Core Config Manager shipped within the Nagios XI virtual appliance, which can be found under http://<vmlocation>/nagiosql/index.php
Remediation
Upgrade to the latest version of Nagios.
References
Related Vulnerabilities
WordPress Plugin GigPress SQL Injection (2.3.28)
WordPress Plugin MicroCopy SQL Injection (1.1.0)
WordPress Plugin Poll, Survey, Questionnaire and Voting system SQL Injection (1.2.4)
WordPress Plugin User Control SQL Injection (2.1.0)
WordPress Plugin 1 Flash Gallery Cross-Site Scripting and SQL Injection Vulnerabilities (0.2.5)