A time-based blind SQL injection vulnerability in LibreNMS allows authenticated attackers to infer sensitive database information, posing a significant risk to data confidentiality and integrity.

The application is susceptible to a time-based blind SQL injection via the address parameter in the address-search.inc.php file. This flaw is triggered when a crafted subnet prefix is processed without proper parameter binding, allowing any authenticated user to manipulate backend database queries.

Successful exploitation of this vulnerability allows an authenticated attacker to perform unauthorized database queries, potentially leading to the extraction of sensitive system data. Given the CVSS score of 8.8, this represents a high-severity risk that could facilitate further compromise of the monitoring infrastructure and the data it manages.

Immediate Action: Update LibreNMS to version 26.2.0 or later to apply the necessary input sanitization and parameter binding fixes.

Proactive Monitoring: Review application logs for suspicious activity involving the address-search.inc.php endpoint and monitor database query duration for anomalous spikes indicative of time-based injection attempts.

Compensating Controls: Implement a Web Application Firewall (WAF) with rules designed to detect and block SQL injection patterns, particularly those involving time-delay functions, to mitigate risk while the update is being staged.

Public Exploit Available: Unknown

This vulnerability presents a high risk to the confidentiality and integrity of the LibreNMS platform. Organizations should prioritize updating to version 26.2.0 immediately to eliminate the injection vector. While the exploit requires authentication, the potential for information disclosure necessitates prompt remediation to prevent unauthorized data access.