CVE-2020-15876 Overview
CVE-2020-15876 is an authenticated SQL injection vulnerability in LibreNMS 1.65, an open-source network monitoring platform. A remote attacker with normal user privileges can inject SQL through the sort parameter of the /ajax_table.php API endpoint. Successful exploitation allows extraction of the entire LibreNMS database, including credentials and monitoring data for every managed device. The flaw affects a broad set of table include files under includes/html/table, spanning inventory, alerting, routing, and sensor views. LibreNMS addressed the issue in release 1.65.1.
Critical Impact
Any authenticated LibreNMS user can exfiltrate the full backend database, exposing device credentials, network topology, and audit data.
Affected Products
- LibreNMS 1.65
- LibreNMS releases prior to 1.65.1
- Deployments exposing /ajax_table.php to authenticated users
Discovery Timeline
- 2026-08-26 - CVE-2020-15876 published to NVD
- 2026-08-26 - Last updated in NVD database
Technical Details for CVE-2020-15876
Vulnerability Analysis
The vulnerability resides in the /ajax_table.php endpoint, which dispatches to numerous table renderers in includes/html/table. Affected renderers include address-search.inc.php, alertlog.inc.php, arp-search.inc.php, as-selection.inc.php, bills.inc.php, device_mibs.inc.php, device_oids.inc.php, edit-ports.inc.php, eventlog.inc.php, inventory.inc.php, ix-list.inc.php, ix-peers.inc.php, mempool-edit.inc.php, mempool.inc.php, mibs.inc.php, poll-log.inc.php, processor-edit.inc.php, processor.inc.php, routing-edit.inc.php, sensors-common.inc.php, storage-edit.inc.php, storage.inc.php, tnmsneinfo.inc.php, and toner.inc.php. Each renderer accepts a sort parameter that is concatenated into ORDER BY clauses without proper sanitization. This is a classic SQL injection [CWE-89] issue reachable by any authenticated account.
Root Cause
The root cause is missing allowlist validation of the sort field name before it is placed into a raw SQL query. LibreNMS treated the parameter as a trusted column identifier rather than untrusted user input, bypassing the parameterized query protections used elsewhere in the codebase.
Attack Vector
An attacker authenticates with any valid LibreNMS account, including low-privilege monitoring users. The attacker then sends a crafted HTTP request to /ajax_table.php supplying a malicious sort parameter. Because the parameter is interpolated into the ORDER BY clause, techniques such as time-based blind injection or subquery injection allow full database extraction, including the users table containing password hashes.
Refer to the Shielder Security Advisory for a technical walkthrough of the injection payload and confirmed exploitation path.
Detection Methods for CVE-2020-15876
Indicators of Compromise
- HTTP requests to /ajax_table.php containing SQL keywords (SELECT, UNION, SLEEP, CASE WHEN) inside the sort parameter.
- Unusual ORDER BY errors or long-running MySQL queries originating from the LibreNMS web user.
- Authenticated sessions from low-privilege accounts issuing bursts of /ajax_table.php calls with varied sort values.
Detection Strategies
- Enable web server access logging and search for ajax_table.php requests where the sort parameter deviates from expected column names.
- Deploy a web application firewall rule that rejects non-alphanumeric characters in the sort parameter for LibreNMS URLs.
- Correlate MySQL slow query logs with LibreNMS PHP session identifiers to surface injection attempts.
Monitoring Recommendations
- Alert on any LibreNMS user account performing bulk row extraction against the users, devices, or devices_perms tables.
- Monitor for new administrative accounts or password changes in LibreNMS following anomalous /ajax_table.php traffic.
- Track outbound data volumes from the LibreNMS host to detect staged database exfiltration.
How to Mitigate CVE-2020-15876
Immediate Actions Required
- Upgrade LibreNMS to version 1.65.1 or later, which patches the sort parameter handling. See the LibreNMS 1.65.1 release notes.
- Rotate all credentials stored in LibreNMS, including SNMP community strings, API tokens, and user passwords, assuming compromise if exposure occurred.
- Audit LibreNMS user accounts and remove unused or shared credentials that could be leveraged to reach the authenticated endpoint.
Patch Information
The fix is included in LibreNMS 1.65.1. Review the upstream diff at the LibreNMS 1.65 to 1.65.1 comparison to confirm the sanitization changes applied to the affected files under includes/html/table. Announcements are tracked on the LibreNMS Community Announcements forum.
Workarounds
- Restrict access to the LibreNMS web interface using network ACLs or VPN to reduce the pool of authenticated attackers.
- Enforce strong, unique passwords and multi-factor authentication for every LibreNMS account.
- Place a reverse proxy in front of LibreNMS that validates the sort parameter against a strict allowlist of column names until patching is complete.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
