CVE-2026-2751

Executive Summary

CVE-2026-2751 is a critical blind SQL injection vulnerability in Centreon Web, specifically within the Service Dependencies module. The flaw allows an authenticated attacker to inject arbitrary SQL queries via unsanitized array keys during the deletion of service dependencies. This can lead to unauthorized data access, modification, or deletion of the Centreon database. The vulnerability affects Centreon Web on Central Server running on Linux. No public proof-of-concept (PoC) or exploit code has been released, and no official patch is available; the vendor recommends upgrading to the fixed versions. The EPSS score is 0.0%, indicating low exploitation likelihood in the wild, but the CVSS score of 8.3 highlights the potential for significant impact.

Supply Chain & Package Security

This vulnerability is not related to a package manager (NPM, PyPI, Go, Ruby) but is a direct web application flaw in Centreon Web. No supply chain implications are present.

CVSS Breakdown & Threat Level

• CVSS Score: 8.3 (High)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: Low (PR:L) – attacker needs valid credentials
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: High (C:H)
• Integrity Impact: High (I:H)
• Availability Impact: High (A:H)

The threat level is High due to the potential for complete database compromise with low attack complexity and minimal privileges required.

Deep Dive & Mechanics

The vulnerability resides in the Service Dependencies deletion functionality. When a user deletes a service dependency, the application processes an array of keys (likely $_POST or $_GET parameters) without proper sanitization. An attacker can inject SQL commands by crafting malicious array keys. For example, a key like 1' OR '1'='1 could be used to manipulate the SQL query.

The injection is blind, meaning the attacker does not see direct output but can infer results based on application behavior (e.g., response time, error messages). This allows for data extraction, modification, or deletion.

The vulnerable code likely uses a loop to iterate over the array keys and directly concatenates them into a SQL DELETE statement without parameterization or escaping.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual):

// Vulnerable: unsanitized array keys
$ids = $_POST['dependency_ids'];
foreach ($ids as $key => $value) {
    $sql = "DELETE FROM service_dependencies WHERE id = '$key'";
    $db->query($sql);
}

Patched Code (Conceptual):

// Patched: use prepared statements
$ids = $_POST['dependency_ids'];
$stmt = $db->prepare("DELETE FROM service_dependencies WHERE id = ?");
foreach ($ids as $key => $value) {
    $stmt->bind_param("i", $key);
    $stmt->execute();
}

The patched version uses prepared statements to ensure the key is treated as data, not executable SQL.

Exploitation & Lab Setup

Red Team

Prerequisites:

• Valid credentials for Centreon Web (low-privilege user)
• Network access to the Centreon Web interface
• Knowledge of the Service Dependencies module

Exploitation Steps:

1. Log in to Centreon Web.
2. Navigate to the Service Dependencies deletion page.
3. Intercept the deletion request using a proxy (e.g., Burp Suite).
4. Modify the array key parameter to inject SQL. For example:
   • Original: dependency_ids[1]=value
   • Modified: dependency_ids[1' OR '1'='1]=value
5. Send the request. The application will execute the injected SQL.
6. Use blind SQL injection techniques (e.g., time-based) to extract data.

Example Payload (Time-Based):

dependency_ids[1' AND SLEEP(5)='1]=value

Blue Team

Detection:

• Monitor for unusual SQL errors in application logs.
• Look for requests with suspicious array key patterns (e.g., containing SQL keywords).
• Use WAF rules to block requests with SQL injection patterns in parameter names.

Hunting:

• Search for HTTP requests to /centreon/service-dependencies/delete with non-numeric keys.
• Analyze database logs for unexpected DELETE queries.

Indicators of Compromise (IOCs)

• Network: HTTP POST requests to /centreon/service-dependencies/delete with array keys containing SQL syntax (e.g., ', OR, AND, SLEEP).
• Logs: Application logs showing SQL errors like You have an error in your SQL syntax or Unknown column.
• Database: Unauthorized modifications to the service_dependencies table or other tables.
• File: No specific file IOCs.

Detection Engineering

YARA Rule

rule CVE_2026_2751_SQLi_ArrayKey {
    meta:
        description = "Detects SQL injection attempts via unsanitized array keys in Centreon Web"
        author = "Valters IT"
        date = "2026-01-01"
        reference = "CVE-2026-2751"
    strings:
        $sqli_pattern = /dependency_ids\[[^\]]*['\"]/
    condition:
        $sqli_pattern
}

Sigma Rule

title: Centreon Web Blind SQL Injection via Array Keys
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects SQL injection attempts in Centreon Web Service Dependencies deletion
author: Valters IT
date: 2026/01/01
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-2751
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: '/centreon/service-dependencies/delete'
        cs-uri-query|re: 'dependency_ids\[[^\]]*['\''"]'
    condition: selection
falsepositives:
    - Legitimate use of special characters in dependency names (unlikely)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2026-2751 Centreon Web Blind SQL Injection"; flow:to_server,established; content:"POST"; http_method; content:"/centreon/service-dependencies/delete"; http_uri; pcre:"/dependency_ids\[[^\]]*['\''"]/"; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade Centreon Web to version 25.10.8, 24.10.20, or 24.04.24.
2. If upgrade is not possible, apply a virtual patch using a WAF to block requests with suspicious array keys.
3. Restrict access to the Service Dependencies module to trusted users only.

Long-Term Measures:

• Implement input validation and parameterized queries for all database interactions.
• Conduct regular security audits and penetration testing.
• Monitor for new patches from Centreon.

Workaround:

• Disable the Service Dependencies deletion functionality temporarily by removing the relevant code or restricting access via .htaccess.

Valters IT