CVE-2025-15029: Centreon Infra Monitoring SQLi Vulnerability

CVE-2025-15029 Overview

CVE-2025-15029 is a critical SQL Injection vulnerability in Centreon Infra Monitoring's Awie export modules. The vulnerability allows unauthenticated attackers to inject malicious SQL commands through improperly neutralized special elements in user-supplied input. This flaw enables remote attackers to interact directly with backend databases without requiring any authentication, potentially leading to complete database compromise, data exfiltration, and arbitrary command execution on affected systems.

Critical Impact

Unauthenticated SQL Injection allows remote attackers to execute arbitrary SQL commands against backend databases, potentially leading to complete system compromise, sensitive data theft, and unauthorized access to monitored infrastructure.

Affected Products

• Centreon Infra Monitoring versions 25.10.0 through 25.10.1
• Centreon Infra Monitoring versions 24.10.0 through 24.10.2
• Centreon Infra Monitoring versions 24.04.0 through 24.04.2

Discovery Timeline

• 2026-01-05 - CVE-2025-15029 published to NVD
• 2026-01-08 - Last updated in NVD database

Technical Details for CVE-2025-15029

Vulnerability Analysis

This SQL Injection vulnerability (CWE-89) exists in the Awie export modules of Centreon Infra Monitoring. The vulnerability stems from inadequate sanitization of user-supplied input before incorporating it into SQL queries. Attackers can exploit this flaw remotely over the network without requiring any authentication or user interaction, making it particularly dangerous for internet-exposed Centreon installations.

The attack complexity is low, meaning exploitation does not require specialized conditions or circumstances. Successful exploitation can result in complete compromise of confidentiality, integrity, and availability of the affected system's data. Attackers could potentially read sensitive monitoring data, modify database contents, or leverage database functionality to execute commands on the underlying operating system.

Root Cause

The root cause of this vulnerability is improper neutralization of special elements used in SQL commands within the Awie export modules. The application fails to properly validate, filter, or escape user-controlled input before constructing SQL queries. This allows attackers to break out of the intended query structure and inject arbitrary SQL syntax that gets executed by the database engine with the privileges of the application's database user.

Attack Vector

The vulnerability is exploitable over the network by unauthenticated users. An attacker can craft malicious HTTP requests containing SQL injection payloads targeting the vulnerable Awie export module endpoints. Since no authentication is required, any network-accessible Centreon installation running vulnerable versions is at risk.

The attack flow typically involves:

1. Identifying a Centreon Infra Monitoring installation with vulnerable Awie export modules
2. Crafting requests with SQL injection payloads in vulnerable parameters
3. Extracting database contents, modifying data, or executing system commands through database-specific functions

For detailed technical information about this vulnerability, refer to the Centreon Security Bulletin CVE-2025-15029.

Detection Methods for CVE-2025-15029

Indicators of Compromise

• Unusual or malformed requests to Awie export module endpoints containing SQL syntax characters such as single quotes, double dashes, semicolons, or UNION keywords
• Database query logs showing unexpected or malicious SQL statements originating from web application contexts
• Anomalous database activity including bulk data extraction, schema enumeration queries, or time-based delays
• Web server access logs with URL-encoded SQL injection payloads in request parameters

Detection Strategies

• Deploy web application firewall (WAF) rules to detect and block common SQL injection patterns targeting Centreon endpoints
• Implement database activity monitoring to alert on suspicious query patterns such as UNION-based attacks, stacked queries, or time-based blind injection attempts
• Monitor authentication and access logs for signs of unauthorized data access or privilege escalation
• Configure intrusion detection systems with signatures for SQL injection attacks targeting monitoring infrastructure

Monitoring Recommendations

• Enable detailed logging on Centreon web application servers and forward logs to a SIEM for correlation and analysis
• Monitor database server performance metrics for anomalies that could indicate blind SQL injection attempts using time delays
• Establish baseline network traffic patterns to and from Centreon servers to detect unusual data exfiltration
• Implement real-time alerting for any access to sensitive database tables without corresponding legitimate application activity

How to Mitigate CVE-2025-15029

Immediate Actions Required

• Update Centreon Infra Monitoring to patched versions: 25.10.2 or later, 24.10.3 or later, or 24.04.3 or later
• If immediate patching is not possible, restrict network access to Centreon installations using firewall rules to limit exposure
• Review database and application logs for evidence of exploitation attempts prior to patching
• Rotate database credentials and review database user privileges to ensure least-privilege principles are followed

Patch Information

Centreon has released security patches addressing this vulnerability. Organizations should upgrade to the following fixed versions:

• Version 25.10.2 or later for the 25.10.x branch
• Version 24.10.3 or later for the 24.10.x branch
• Version 24.04.3 or later for the 24.04.x branch

Patch downloads and release notes are available at the GitHub Centreon Release Notes. For additional details, consult the Centreon Security Bulletin CVE-2025-15029.

Workarounds

• Implement network-level access controls to restrict access to Centreon Infra Monitoring to trusted IP addresses only
• Deploy a web application firewall with SQL injection detection rules in front of Centreon installations
• Disable or restrict access to the Awie export modules if not required for business operations until patching can be completed
• Consider network segmentation to isolate monitoring infrastructure from general network access

# Example: Restrict access to Centreon using iptables
# Allow only trusted management network
iptables -A INPUT -p tcp --dport 80 -s 10.0.0.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -s 10.0.0.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 80 -j DROP
iptables -A INPUT -p tcp --dport 443 -j DROP