CVE-2023-40931

MediumCVSS 6.5/10Last modified Jul 9, 2026

Description

A SQL injection vulnerability in Nagios XI from version 5.11.0 up to and including 5.11.1 allows authenticated attackers to execute arbitrary SQL commands via the ID parameter in the POST request to /nagiosxi/admin/banner_message-ajaxhelper.php

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-89

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://outpost24.com/blog/nagios-xi-vulnerabilities/Third Party Advisory
https://www.nagios.com/products/security/Vendor Advisory
https://outpost24.com/blog/nagios-xi-vulnerabilities/Third Party Advisory
https://www.nagios.com/products/security/Vendor Advisory

Timeline

Published: Sep 19, 2023
Last modified: Jul 9, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-409325.4A Cross-site scripting (XSS) vulnerability in Nagios XI version 5.11.1 and below allows authenticated attackers with access to the custom lo CVE-2023-409338.8A SQL injection vulnerability in Nagios XI v5.11.1 and below allows authenticated attackers with announcement banner configuration privilege CVE-2023-409347.2A SQL injection vulnerability in Nagios XI 5.11.1 and below allows authenticated attackers with privileges to manage host escalations in the CVE-2023-40948.2ARCONTE Aurea's authentication system, in its 1.5.0.0 version, could allow an attacker to make incorrect access requests in order to block e CVE-2023-409429.8Tenda AC9 V3.0BR_V15.03.06.42_multi_TD01 was discovered stack overflow via parameter 'firewall_value' at url /goform/SetFirewallCfg.CVE-2023-409449.8Schoolmate 1.3 is vulnerable to SQL Injection in the variable $schoolname from Database at ~\header.php.CVE-2023-409459.8Sourcecodester Doctor Appointment System 1.0 is vulnerable to SQL Injection in the variable $userid at doctors\myDetails.php.CVE-2023-409469.8Schoolmate 1.3 is vulnerable to SQL Injection in the variable $username from SESSION in ValidateLogin.php.CVE-2023-40955.3User enumeration vulnerability in Arconte Áurea 1.5.0.0 version. The exploitation of this vulnerability could allow an attacker to obtain a CVE-2023-409538.8icms 7.0.16 is vulnerable to Cross Site Request Forgery (CSRF).CVE-2023-409549.8A SQL injection vulnerability in Grzegorz Marczynski Dynamic Progress Bar (aka web_progress) v. 11.0 through 11.0.2, v12.0 through v12.0.2, CVE-2023-409558.8A SQL injection vulnerability in Didotech srl Engineering & Lifecycle Management (aka pdm) v.14.0, v.15.0 and v.16.0 fixed in pdm-14.0.1.0.0