Exploit for SQL Injection in Nagios Nagios Xi

## https://sploitus.com/exploit?id=B95BA3C8-FD29-5C5A-B981-CF4F01F7EEB3
# CVE-2023-48084 — updated PoC

**Repository:** [MettHK/CVE-2023-48084-Revised](https://github.com/MettHK/CVE-2023-48084-Revised)

Updated version of [Hamibubu/CVE-2023-48084](https://github.com/Hamibubu/CVE-2023-48084)
with multithreading, binary-search extraction, and CLI flags for database / table / column selection.

**Not the original repository.** This is a derivative/improved PoC. Credit for the original work goes to [Hamibubu](https://github.com/Hamibubu).

## Disclaimer

For **authorized security testing and educational use only**. Do not use this against systems you do not own or do not have explicit permission to test. The authors and contributors are not responsible for misuse.

## About the vulnerability

[CVE-2023-48084](https://nvd.nist.gov/vuln/detail/CVE-2023-48084): Nagios XI before version 5.11.3 contains a SQL injection vulnerability via the bulk modification tool.

This PoC abuses a **time-based blind SQL injection** on:

```text
/admin/banner_message-ajaxhelper.php?action=acknowledge_banner_message&id=(SQL)
```

You need a valid **non-admin session cookie** (`nagiosxi`) or an **API token**.

## Changes from the original

| Area | What changed |
|------|----------------|
| Extraction | Binary search for string length and ASCII characters (far fewer requests) |
| Performance | Multithreaded character extraction (`-w` / `--workers`) |
| CLI | `-d` / `--database` — skip schema discovery |
| CLI | `-t` / `--table` — skip table discovery (requires `-d`) |
| CLI | `-C` / `--columns` — comma-separated columns, skip column discovery (requires `-t`) |
| Timing | Configurable `--delay`, `--threshold`, `--max-length` |
| Robustness | Per-thread HTTP sessions; optional `pwntools` (progress bars) with a plain fallback |
| Docs | Credit/link to original; no lab hostnames or CTF artifacts in examples |

## Requirements

- Python 3.8+
- `requests` (required)
- `pwntools` (optional; nicer progress output)

```bash
git clone https://github.com/MettHK/CVE-2023-48084-Revised.git
cd CVE-2023-48084-Revised
pip install -r requirements.txt
```

## Usage

```bash
# Interactive (discover schemas → tables → columns)
python3 CVE-2023-48084.py -u https://target.example/nagiosxi -c ''
python3 CVE-2023-48084.py -u https://target.example/nagiosxi -a ''

# Fast path: database + table + columns known
python3 CVE-2023-48084.py \
  -u https://target.example/nagiosxi \
  -c '' \
  -d nagiosxi \
  -t xi_users \
  -C username,email,password \
  -w 15 \
  --delay 1.2
```

> I don't recommend to use more than 2 workers as it may give back incorrect results 

### Options

| Flag | Description |
|------|-------------|
| `-u` / `--url` | Base URL (e.g. `https://target.example/nagiosxi`) |
| `-c` / `--cookie` | Value of the `nagiosxi` session cookie |
| `-a` / `--apiKey` | API token (do not use together with `-c`) |
| `-d` / `--database` | Schema/database name (skip schema enum) |
| `-t` / `--table` | Table name (skip table enum; needs `-d`) |
| `-C` / `--columns` | Comma-separated columns (skip column enum; needs `-t`) |
| `-w` / `--workers` | Parallel threads (default: `10`) |
| `--delay` | `SLEEP` seconds on true branch (default: `1.5`) |
| `--threshold` | Min response time to count as hit (default: `delay * 0.8`) |
| `--max-length` | Upper bound for length binary search (default: `2048`) |

### Tips

- Wrong characters / noisy results → increase `--delay` (e.g. `2`) or lower `-w` (e.g. `5`).
- Stable, fast target → try higher workers (`-w 15`–`20`).
- Prefer `-d` / `-t` / `-C` when you already know the target schema to avoid long discovery.