An unauthenticated user is able to introduce SQL Injection using the Awie export module

The SQL Injection vulnerability in Centreon Infra Monitoring's Awie export modules poses a significant risk. An attacker could leverage this flaw to bypass authentication and directly execute arbitrary SQL queries against the underlying database. This could lead to the exfiltration of sensitive data, including user credentials, monitoring configurations, and potentially even system logs. Furthermore, successful exploitation could allow an attacker to modify or delete data, disrupt monitoring services, or even gain control of the Centreon server itself. The unauthenticated nature of the vulnerability amplifies the potential impact, as it requires no prior access or credentials to exploit.

Organizations heavily reliant on Centreon Infra Monitoring for infrastructure visibility and alerting are particularly at risk. Shared hosting environments where multiple Centreon instances share a database are also vulnerable, as a compromise of one instance could potentially impact others. Legacy deployments using older versions of Centreon are especially susceptible.

• linux / server: Examine Centreon's database logs (typically in /var/log/mysql/error.log or similar) for unusual SQL queries or error messages related to injection attempts. Use journalctl -u mysql to filter for relevant events. • database (mysql): Execute the following query to check for potentially malicious stored procedures or functions:

SHOW PROCEDURE STATUS WHERE Db = 'centreon' AND Name LIKE '%injection%';

• generic web: Use curl to test the vulnerable endpoint with a simple SQL injection payload (e.g., curl 'http://your-centreon-server/awie/export?param=1' UNION SELECT 1,2,3 -- -). Analyze the response for errors or unexpected data.

1. 2026-01-05Disclosure

   disclosure

1. Réservé2025-12-22
2. Publiée2026-01-05
3. Modifiée2026-01-08
4. EPSS mis à jour2026-03-23

The primary mitigation for CVE-2025-15029 is to immediately upgrade Centreon Infra Monitoring to version 25.10.2 or later. If upgrading is not immediately feasible, consider implementing temporary workarounds. While a direct WAF rule is difficult to create due to the nature of SQL injection, strict input validation on all user-supplied data used in SQL queries is crucial. Review and harden database user permissions, limiting access to only necessary data. Monitor database logs for suspicious SQL activity. After upgrading, confirm the fix by attempting to trigger the vulnerable endpoint with a known SQL injection payload and verifying that it is properly sanitized.