CVE-2020-15878: LibreNMS SQL Injection Vulnerability

CVE-2020-15878 Overview

CVE-2020-15878 is an authenticated SQL injection vulnerability in LibreNMS 1.65, an open-source network monitoring platform. A remote attacker with normal (non-administrative) privileges can inject SQL through the address parameter of the /ajax_table.php API endpoint. Successful exploitation allows extraction of arbitrary data from the underlying LibreNMS database, including credentials, device inventory, and monitoring records. The issue was addressed in LibreNMS release 1.65.1.

Critical Impact
Any authenticated LibreNMS user can read the full contents of the monitoring database, exposing device credentials, SNMP community strings, and infrastructure topology.

Affected Products

LibreNMS 1.65
Deployments running the /ajax_table.php endpoint prior to 1.65.1
Self-hosted LibreNMS instances accessible to authenticated users

Discovery Timeline

2026-08-26 - CVE-2020-15878 published to NVD
2026-08-26 - Last updated in NVD database

Technical Details for CVE-2020-15878

Vulnerability Analysis

The vulnerability resides in the /ajax_table.php API endpoint of LibreNMS 1.65. The address request parameter flows into a database query without proper sanitization or parameterization. An authenticated attacker submits crafted SQL fragments through this parameter to alter the query logic. The database engine executes the injected clauses under the privileges of the LibreNMS application user.

SQL injection in a monitoring platform is impactful because the backend stores privileged operational data. LibreNMS databases typically hold SNMP community strings, SSH credentials for device polling, API tokens, and topology information. An attacker can enumerate tables, dump user password hashes, and pivot toward network infrastructure using recovered credentials.

The vendor released LibreNMS 1.65.1 to fix the flaw. Details are documented in the Shielder Security Advisory and the GitHub LibreNMS Version Comparison.

Root Cause

The root cause is improper neutralization of special elements used in an SQL command [CWE-89]. The address parameter received by ajax_table.php is concatenated into a query string rather than bound as a parameter. The application trusts input from authenticated sessions and applies no allow-list validation or escaping before query execution.

Attack Vector

Exploitation requires an authenticated session with normal user privileges, which lowers the barrier compared to admin-only functionality. The attacker sends an HTTP request to /ajax_table.php with a malicious address parameter value containing SQL syntax. The response reflects data or timing behavior that enables union-based or blind extraction of arbitrary rows.

See the Shielder Security Advisory for the specific request format and payload structure.

Detection Methods for CVE-2020-15878

Indicators of Compromise

HTTP requests to /ajax_table.php containing SQL metacharacters such as ', --, UNION, SELECT, or SLEEP( in the address parameter.
Unusually long or URL-encoded address parameter values in web server access logs.
LibreNMS application logs showing MySQL/MariaDB syntax errors originating from ajax_table.php.
Authenticated sessions issuing high volumes of requests to ajax_table.php inconsistent with normal UI usage.

Detection Strategies

Deploy web application firewall (WAF) rules that flag SQL injection patterns targeting the address query parameter on LibreNMS endpoints.
Correlate LibreNMS access logs with database error logs to surface injection attempts that produced syntax errors.
Baseline normal ajax_table.php request patterns per user and alert on statistical outliers in parameter length or entropy.

Monitoring Recommendations

Forward LibreNMS web server and MySQL query logs to a centralized SIEM for retention and correlation.
Alert on any LibreNMS user account issuing requests containing information_schema, sleep(, or benchmark( strings.
Monitor for outbound connections from the LibreNMS host to unexpected destinations following suspicious query activity.

How to Mitigate CVE-2020-15878

Immediate Actions Required

Upgrade LibreNMS to version 1.65.1 or later as documented in the GitHub LibreNMS Release Note.
Rotate all SNMP community strings, SSH credentials, and API tokens stored in the LibreNMS database, as they may have been extracted.
Audit LibreNMS user accounts and remove any unused or shared low-privilege accounts.
Restrict LibreNMS web interface access to trusted management networks via network ACLs or VPN.

Patch Information

The fix is included in LibreNMS 1.65.1. Apply the upgrade using the standard LibreNMS update process (./daily.sh or git pull followed by composer update, depending on installation method). Review the GitHub LibreNMS Version Comparison for the exact code changes and confirm the patched files are deployed.

Workarounds

If immediate patching is not feasible, restrict /ajax_table.php access at the reverse proxy to administrator IP ranges only.
Deploy WAF signatures that block SQL metacharacters in the address parameter of LibreNMS requests.
Reduce the LibreNMS database user's privileges to the minimum required, removing FILE and other unnecessary permissions.

bash

# Upgrade LibreNMS to patched version
cd /opt/librenms
sudo -u librenms git fetch --tags
sudo -u librenms git checkout 1.65.1
sudo -u librenms ./scripts/composer_wrapper.php install --no-dev
sudo -u librenms php artisan migrate --force