An authenticated SQL injection vulnerability in LibreNMS version 1.46 allows remote attackers to compromise database integrity and confidentiality.

This is a time-based blind SQL injection vulnerability (CWE-89) located in the MAC accounting graph endpoint. An authenticated attacker can exploit this by manipulating the 'sort' parameter with crafted SQL commands to retrieve sensitive data from the underlying database.

The ability to perform blind SQL injection poses a significant risk to data confidentiality, as an attacker can extract user credentials, configuration details, or other sensitive information stored within the LibreNMS database. With a CVSS score of 7.1, this vulnerability is classified as High, reflecting the potential for unauthorized data exfiltration and the compromise of internal monitoring systems which often hold privileged network information.

Immediate Action: Update LibreNMS to a patched version (version 1.69 or later is recommended by the community) to eliminate the vulnerable code path.

Proactive Monitoring: Review web access logs for suspicious requests to the 'graph.php' endpoint, particularly those containing SQL syntax characters or unexpected 'sort' parameter values.

Compensating Controls: Deploy a Web Application Firewall (WAF) configured to inspect and block SQL injection patterns in incoming GET requests to the LibreNMS web interface.

Public Exploit Available: Yes, a functional exploit script is publicly available via ExploitDB (EDB-ID: 49246).

Given the availability of a functional proof-of-concept exploit and the high severity of SQL injection, organizations running LibreNMS 1.46 must prioritize upgrading to a current version. Ensuring that administrative access is restricted and strictly monitored is essential until the patch is successfully applied.