References https://ddpoc.com/DVB-2026-10628.html https://www.tenablecloud.cn/plugins/nessus/49773 https://www.tenable.com/plugins/nessus/49773 https://jackiechen.blog/2011/04/27/nagios-xi-some-tricks/ https://support.nagios.com/forum/viewtopic.php?t=544 https://kashz.gitbook.io/kashz-jewels/services/nagios-xi https://medium.com/@YNS21/exploiting-nagios-xi-rce-vulnerability-b916ba296c36 https://www.cnblogs.com/azwhikaru/p/17144638.html https://github.com/runZeroInc/nuclei-templates/blob/main/http/default-logins/nagios/nagiosxi-default-login.yaml
Related VulnerabilitiesNagios Log Server 需授权 命令注入漏洞Nagios Log Server 权限管理不当漏洞PoCCVE-2018-10735: NagiosXI <= 5.4.12 `commandline.php` SQL injectionPoCCVE-2018-10736: NagiosXI <= 5.4.12 - SQL injectionPoCCVE-2018-10737: NagiosXI <= 5.4.12 logbook.php SQL injectionPoCCVE-2018-10738: NagiosXI <= 5.4.12 menuaccess.php - SQL injectionPoCCVE-2021-25296: Nagios XI 5.5.6-5.7.5 - Authenticated Remote Command InjectionPoCCVE-2021-25297: Nagios 5.5.6-5.7.5 - Authenticated Remote Command InjectionPoCCVE-2021-25298: Nagios XI 5.5.6-5.7.5 - Authenticated Remote Command InjectionPoCCVE-2021-25299: Nagios XI 5.7.5 - Cross-Site ScriptingPoCCVE-2021-38156: Nagios XI < 5.8.6 - Cross-Site Scripting