A high-severity SQL injection vulnerability in Centreon Web allows authenticated administrators to compromise the backend database and gain full control over the application.

The application is susceptible to CWE-89, an Improper Neutralization of Special Elements used in an SQL Command. A user with high privileges can trigger this flaw through the Meta Service indicator page to perform unauthorized database operations.

The ability for a high-privileged user to execute arbitrary SQL commands poses a severe risk to data integrity and confidentiality. Successful exploitation could lead to full unauthorized access to monitoring data, modification of system configurations, or potential remote code execution on the underlying database server. With a CVSS score of 7.2, this vulnerability represents a significant threat to internal infrastructure stability and operational security.

Immediate Action: Update the Centreon Web installation to the latest patched version as specified in the official security bulletin provided by the vendor.

Proactive Monitoring: Audit database access logs for unusual queries or unexpected syntax patterns emanating from administrative user accounts.

Compensating Controls: Implement strict role-based access control to limit the number of users with administrative privileges, and deploy a Web Application Firewall to detect and block common SQL injection patterns.

Public Exploit Available: No (exploit_available: unknown)

Given the potential for complete database compromise, organizations using the affected versions of Centreon Web must prioritize this update. Administrators should verify their current version string against the provided list and apply the necessary patches immediately to prevent potential exploitation by malicious or compromised administrative accounts.