CVE-2025-15029

Executive Summary

CVE-2025-15029 is a critical unauthenticated SQL Injection vulnerability in Centreon Infra Monitoring, specifically within the Awie export modules. The flaw allows a remote, unauthenticated attacker to inject arbitrary SQL commands, leading to full compromise of the database, including extraction of credentials, configuration data, and monitoring data. With a CVSS score of 9.8, this vulnerability is considered critical and should be patched immediately. No public proof-of-concept (PoC) or exploit code has been released at this time, but the risk of weaponization is high given the unauthenticated nature of the attack.

CVSS Breakdown & Threat Level

• CVSS Score: 9.8 (Critical)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: High
• Integrity Impact: High
• Availability Impact: High

The vulnerability is trivially exploitable by any unauthenticated attacker with network access to the Centreon Infra Monitoring interface. The lack of authentication and low complexity make it a prime target for automated scanning and exploitation.

Deep Dive & Mechanics

The vulnerability resides in the Awie export modules of Centreon Infra Monitoring. These modules are responsible for exporting monitoring data in various formats. The application fails to properly neutralize special elements used in SQL commands when processing user-supplied input to the export functionality.

An attacker can craft a malicious HTTP request to the export endpoint, injecting SQL commands into parameters that are directly concatenated into SQL queries. Because the application does not enforce authentication for these export actions, the attacker can execute arbitrary SQL statements against the backend database.

The injection point is likely in a parameter such as export_type, filter, or id that is passed to the export module. The SQL query is built using string concatenation without parameterized statements or proper escaping.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual):

// Vulnerable: Direct concatenation of user input
$export_type = $_GET['export_type'];
$query = "SELECT * FROM monitoring_data WHERE type = '$export_type'";
$result = mysqli_query($conn, $query);

Patched Code (Conceptual):

// Patched: Use of prepared statements
$export_type = $_GET['export_type'];
$stmt = $conn->prepare("SELECT * FROM monitoring_data WHERE type = ?");
$stmt->bind_param("s", $export_type);
$stmt->execute();
$result = $stmt->get_result();

The patched version uses parameterized queries, which prevent SQL injection by separating SQL logic from data.

Exploitation & Lab Setup

Red Team

Lab Setup:

1. Deploy a vulnerable Centreon Infra Monitoring instance (version 24.04.0, 24.10.0, or 25.10.0).
2. Ensure the Awie export module is enabled.
3. Use a tool like sqlmap or manual HTTP requests to test.

Exploitation Steps:

1. Identify the vulnerable endpoint (likely /centreon/api/export/awie or similar).
2. Inject SQL payload into a parameter (e.g., export_type).
3. Example request:

   GET /centreon/api/export/awie?export_type=1' UNION SELECT 1,2,3,4,5,6,7,8,9,10-- HTTP/1.1
   Host: target
   

4. Use sqlmap for automated exploitation:

   sqlmap -u "http://target/centreon/api/export/awie?export_type=1" --batch --dbs
   

Expected Outcome: Full database dump, including user credentials and monitoring data.

Blue Team

Detection:

• Monitor for SQL injection patterns in HTTP requests to export endpoints.
• Look for unusual characters like single quotes ('), double dashes (--), or UNION keywords in GET/POST parameters.
• Alert on requests to /centreon/api/export/awie or similar paths with abnormal parameter lengths.

Hunting:

• Search logs for export_type parameters containing SQL keywords.
• Correlate with database error logs for SQL syntax errors.

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP requests to /centreon/api/export/awie with SQL-like payloads.
  • Unusual database error messages in application logs (e.g., "You have an error in your SQL syntax").
• File IOCs:
  • Modified or new files in the Centreon web directory (e.g., webshells).
• System IOCs:
  • Unexpected database connections from the Centreon server.
  • New user accounts or elevated privileges in the database.

Detection Engineering

YARA Rule

rule CVE_2025_15029_SQLi_Attempt {
    meta:
        description = "Detects SQL injection attempts targeting Centreon Awie export module"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-15029"
    strings:
        $sqli1 = "export_type=" nocase
        $sqli2 = "' OR '" nocase
        $sqli3 = "UNION SELECT" nocase
        $sqli4 = "--" nocase
        $sqli5 = "1=1" nocase
    condition:
        any of ($sqli*) and #sqli1 > 0
}

Sigma Rule

title: CVE-2025-15029 SQL Injection Attempt
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects SQL injection attempts against Centreon Awie export module
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'GET'
        cs-uri-query|contains: 
            - 'export_type='
            - "'"
            - '--'
            - 'UNION'
            - 'SELECT'
    condition: selection
falsepositives:
    - Legitimate use of special characters in export filters (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-15029 SQL Injection Attempt"; flow:to_server,established; content:"GET"; http_method; content:"/centreon/api/export/awie"; http_uri; content:"export_type="; http_uri; pcre:"/(\x27|--|UNION|SELECT)/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade Centreon Infra Monitoring to the patched versions:
   • 24.04.3
   • 24.10.3
   • 25.10.2
2. If immediate patching is not possible, implement a Web Application Firewall (WAF) rule to block SQL injection patterns on the export endpoint.
3. Restrict network access to the Centreon web interface to trusted IPs only.

Long-term Measures:

• Enforce use of parameterized queries in all database interactions.
• Conduct regular code reviews and penetration testing.
• Implement least privilege for database accounts used by the application.

Valters IT Signature:
This report was generated by Valters IT Cyber Threat Intelligence. For questions, contact intelligence@valters-it.com.