CVE-2020-15875: LibreNMS SQL Injection Vulnerability

CVE-2020-15875 Overview

CVE-2020-15875 is an authenticated SQL injection vulnerability in LibreNMS 1.65, an open-source network monitoring platform. A remote authenticated attacker with normal privileges can inject SQL through the searchPhrase parameter of the /ajax_table.php API endpoint. The flaw allows extraction of arbitrary data from the LibreNMS database. It affects numerous table include files under includes/html/table, including alerts.inc.php, eventlog.inc.php, inventory.inc.php, and others. The vulnerability is classified under CWE-89 (Improper Neutralization of Special Elements used in an SQL Command).

Critical Impact
Any authenticated LibreNMS user, regardless of role, can exfiltrate the entire monitoring database, including device credentials, SNMP community strings, and topology data.

Affected Products

LibreNMS 1.65
LibreNMS releases prior to 1.65.1
Deployments exposing /ajax_table.php to authenticated users

Discovery Timeline

2026-09-13 - CVE-2020-15875 published to NVD
2026-09-14 - Last updated in NVD database

Technical Details for CVE-2020-15875

Vulnerability Analysis

The vulnerability resides in the LibreNMS ajax_table.php endpoint, which dispatches search and sort operations to per-table include files under includes/html/table. User-supplied input from the searchPhrase request parameter is concatenated directly into SQL query strings without parameterization or sanitization. Because the endpoint is reachable by any authenticated account, a low-privileged user can pivot from monitoring visibility to full database read access.

Affected include files span nearly every monitored asset class in LibreNMS, including as-selection.inc.php, edit-ports.inc.php, alertlog-stats.inc.php, alerts.inc.php, eventlog.inc.php, inventory.inc.php, ix-list.inc.php, ix-peers.inc.php, mempool.inc.php, poll-log.inc.php, processor.inc.php, routing-edit.inc.php, sensors-common.inc.php, storage.inc.php, and toner.inc.php.

Root Cause

The root cause is direct string concatenation of the searchPhrase parameter and other request fields into SQL WHERE and ORDER BY clauses. The sort handler additionally trusted array keys and values from $_REQUEST without validating column names or sort direction, allowing arbitrary SQL fragments to reach the query builder.

Attack Vector

An authenticated attacker sends a crafted POST or GET request to /ajax_table.php with a malicious searchPhrase value. The payload closes the intended LIKE clause and appends UNION SELECT statements or boolean-based blind injection primitives. The database backend executes the injected SQL under the LibreNMS service account, returning results within the JSON response.

php

// Security patch in html/ajax_table.php - Fix SQL injections (#11920)
 settype($current, 'integer');
 $rowCount = $_REQUEST['rowCount'];
 settype($rowCount, 'integer');
-if (isset($_REQUEST['sort']) && is_array($_POST['sort'])) {
+if (isset($_REQUEST['sort']) && is_array($_REQUEST['sort'])) {
     foreach ($_REQUEST['sort'] as $k => $v) {
+        $k = preg_replace('/[^A-Za-z0-9_]/', '', $k); // only allow plain columns
+        $v = strtolower($v) == 'desc' ? 'DESC' : 'ASC';
         $sort .= " $k $v";
     }
 }

Source: GitHub Commit 32f72bc1ab7e

The patch restricts sort keys to alphanumeric characters and normalizes the direction to ASC or DESC. A second patch converts vulnerable LIKE concatenations into parameterized queries:

php

// Security patch in includes/html/table/address-search.inc.php
     $sql  = ' FROM `ipv4_addresses` AS A, `ports` AS I, `ipv4_networks` AS N, `devices` AS D';
     $sql .= " WHERE I.port_id = A.port_id AND I.device_id = D.device_id AND N.ipv4_network_id = A.ipv4_network_id $where ";
     if (!empty($address)) {
-        $sql .= " AND ipv4_address LIKE '%".$address."%'";
+        $sql .= " AND ipv4_address LIKE ?";
+        $param[] = "%$address%";
     }

Source: GitHub Commit 32f72bc1ab7e

Detection Methods for CVE-2020-15875

Indicators of Compromise

Requests to /ajax_table.php containing SQL metacharacters such as UNION, SELECT, SLEEP(, --, or 0x in the searchPhrase parameter.
Unusual sort parameter values containing spaces, parentheses, or non-alphanumeric characters.
Abnormally large or slow JSON responses from /ajax_table.php compared to baseline.
Web server access logs showing repeated ajax_table.php requests from a single authenticated session.

Detection Strategies

Deploy a web application firewall rule inspecting the searchPhrase and sort parameters on /ajax_table.php for SQL syntax.
Enable MySQL/MariaDB general query logging temporarily and hunt for queries referencing information_schema originating from the LibreNMS user.
Correlate LibreNMS authentication logs with spikes in ajax_table.php request volume per user.

Monitoring Recommendations

Forward LibreNMS web server logs and database audit logs to a centralized SIEM for retention and correlation.
Alert on any LibreNMS user account issuing queries that access system tables such as users, devices_perms, or mysql.user.
Track outbound data volume from the LibreNMS host to detect bulk exfiltration following a successful injection.

How to Mitigate CVE-2020-15875

Immediate Actions Required

Upgrade LibreNMS to version 1.65.1 or later, which contains the fixes from pull request #11920.
Rotate all SNMP community strings, device credentials, and API tokens stored in the LibreNMS database.
Audit LibreNMS user accounts and disable any that are unused or shared.
Restrict access to the LibreNMS web interface to trusted management networks using network ACLs or VPN.

Patch Information

The fix is delivered in LibreNMS release 1.65.1. The full set of changes is visible in the 1.65 to 1.65.1 comparison and the underlying commit 32f72bc1ab7e. See the Shielder Security Advisory for the original disclosure.

Workarounds

Block or restrict access to /ajax_table.php at a reverse proxy for source addresses outside the administrative network.
Apply a WAF signature that rejects searchPhrase and sort values containing SQL keywords or non-alphanumeric characters.
Enforce least privilege on the MySQL/MariaDB account used by LibreNMS so that it cannot read tables outside its own schema.

bash

# Upgrade LibreNMS to a patched release
cd /opt/librenms
sudo -u librenms git fetch --tags
sudo -u librenms git checkout 1.65.1
sudo -u librenms ./scripts/composer_wrapper.php install --no-dev
sudo -u librenms php artisan migrate
sudo systemctl restart nginx php-fpm