CVE-2020-15876 in LibreNMS
Summary
by MITRE • 08/26/2026
An issue was discovered in LibreNMS 1.65. A remote authenticated attacker with normal privileges can extract all the information from the LibreNMS database via a SQL injection in the sort parameter in the /ajax_table.php API endpoint. This affects address-search.inc.php, alertlog.inc.php, arp-search.inc.php, as-selection.inc.php, bills.inc.php, device_mibs.inc.php, device_oids.inc.php, edit-ports.inc.php, eventlog.inc.php, inventory.inc.php, ix-list.inc.php, ix-peers.inc.php, mempool-edit.inc.php, mempool.inc.php, mibs.inc.php, poll-log.inc.php, processor-edit.inc.php, processor.inc.php, routing-edit.inc.php, sensors-common.inc.php, storage-edit.inc.php, storage.inc.php, tnmsneinfo.inc.php, and toner.inc.php (in includes/html/table).
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 08/26/2026
The vulnerability identified in LibreNMS version 1.65 represents a critical security flaw within the application's web interface, specifically targeting multiple API endpoints that handle data retrieval and display functions. This issue is classified as an SQL injection vulnerability, which allows for unauthorized access to sensitive information stored in the backend database. The root cause of this weakness lies in the improper handling of user-supplied input within the sort parameter used by various PHP scripts located in the includes/html/table directory. These scripts include address-search.inc.php, alertlog.inc.php, arp-search.inc.php, as-selection.inc.php, bills.inc.php, device_mibs.inc.php, device_oids.inc.php, edit-ports.inc.php, eventlog.inc.php, inventory.inc.php, ix-list.inc.php, ix-peers.inc.php, mempool-edit.inc.php, mempool.inc.php, mibs.inc.php, poll-log.inc.php, processor-edit.inc.php, processor.inc.php, routing-edit.inc.php, sensors-common.inc.php, storage-edit.inc.php, storage.inc.php, tnmsneinfo.inc.php, and toner.inc.php. Because these files are part of the core functionality for displaying network data, their compromise significantly expands the attack surface available to malicious actors who have gained access to the system.
The operational impact of this vulnerability is severe due to its nature as a remote authenticated attack vector requiring only normal user privileges. This low barrier to entry means that any legitimate user account with standard permissions can exploit the flaw without needing elevated administrative rights or complex authentication bypasses. By manipulating the sort parameter in requests directed at the /ajax_table.php endpoint, an attacker can inject arbitrary SQL commands into the database queries executed by LibreNMS. This capability enables the extraction of all information contained within the LibreNMS database, which typically includes sensitive network topology data, device configurations, user credentials, alert logs, and potentially other proprietary or confidential organizational data. The ability to dump the entire database compromises the confidentiality integrity of the monitoring system and can serve as a stepping stone for further lateral movement within the internal network if additional vulnerabilities are present in connected systems.
From a technical classification perspective, this vulnerability aligns with CWE-89 Improper Neutralization of Special Elements used in an SQL Command commonly known as SQL Injection. The flaw arises because the application fails to properly sanitize or parameterize user input before incorporating it into dynamic database queries. This lack of validation allows special characters and SQL syntax elements to be interpreted by the underlying database management system rather than being treated as literal string data. Furthermore, this attack pattern corresponds to MITRE ATT&CK technique T1059 Command and Scripting Interpreter through PHP, specifically leveraging input manipulation to execute unauthorized commands against the backend infrastructure. The widespread nature of the affected files indicates a systemic issue in how the application framework handles sorting parameters across multiple modules rather than an isolated coding error in a single component.
Mitigation strategies for this vulnerability must focus on immediate remediation and long-term defensive posture improvements. Administrators should apply the official patch released by LibreNMS to update their installations to a version where this SQL injection flaw has been resolved. In addition to updating software, it is crucial to implement input validation mechanisms that strictly enforce expected data types and formats for all user-supplied parameters, particularly those used in database queries. Utilizing prepared statements with parameterized queries instead of string concatenation when building SQL commands will effectively neutralize this class of attacks by ensuring that user input is always treated as data rather than executable code. Furthermore organizations should review their access control policies to ensure that the principle of least privilege is strictly enforced, limiting what actions authenticated users can perform and reducing the potential impact if an account is compromised. Regular security audits and penetration testing focused on web application vulnerabilities will help identify similar weaknesses in other parts of the infrastructure before they can be exploited by adversaries.