Centreon version 19.10.5 suffers from a database credential disclosure vulnerability.
015b6cc11fc60b7914ed4e83bae7f78e# Exploit Title: Centreon 19.10.5 - Database Credentials Disclosure
# Date: 2020-01-27
# Exploit Author: Fabien AUNAY, Omri Baso
# Vendor Homepage: https://www.centreon.com/
# Software Link: https://github.com/centreon/centreon
# Version: 19.10.5
# Tested on: CentOS 7
# CVE : -
###########################################################################################################
Centreon 19.10.5 Database Credentials Disclosure
Trusted by SMBs and Fortune 500 companies worldwide.
An industry reference in IT Infrastructure monitoring for the enterprise.
Counts 200,000+ ITOM users worldwide and an international community of software collaborators.
Presence in Toronto and Luxembourg.
Deployed in diverse sectors:
- IT & telecommunication
- Transportation
- Government
- Heath care
- Retail
- Utilities
- Finance & Insurance
- Aerospace & Defense
- Manufacturing
- etc.
###########################################################################################################
POC:
- Configuration / Pollers / Broker configuration
-- Central-broker | Central-broker-master
--- Output
It is possible to discover the unencrypted password with the inspector.
DB user centreon
DB password ********
<input size="120" name="output[0][db_password]" type="password" value="ZVy892xx">