cve/2019/CVE-2019-20197.md

CVE-2019-20197

Description

In Nagios XI 5.6.9, an authenticated user is able to execute arbitrary OS commands via shell metacharacters in the id parameter to schedulereport.php, in the context of the web-server user account.

POC

Reference

• https://code610.blogspot.com/2019/12/postauth-rce-in-latest-nagiosxi.html
• https://code610.blogspot.com/2019/12/postauth-rce-in-latest-nagiosxi.html

Github

• https://github.com/0xT11/CVE-POC
• https://github.com/ARPSyndicate/cvemon
• https://github.com/developer3000S/PoC-in-GitHub
• https://github.com/hectorgie/PoC-in-GitHub
• https://github.com/jas502n/CVE-2019-20197
• https://github.com/lnick2023/nicenice
• https://github.com/lp008/CVE-2019-20197
• https://github.com/qazbnm456/awesome-cve-poc
• https://github.com/r0eXpeR/redteam_vul
• https://github.com/xbl3/awesome-cve-poc_qazbnm456
• https://github.com/xu-xiang/awesome-security-vul-llm