CVE-2025-67255
Product: Nagios XI
Affected Version: 2026R1.0.1 (Build 1762361101)
Vulnerability Type: SQL Injection
CVSS v3.1 Score: 8.1
Severity: High
Attack Vector: Network
Authentication Required: Yes (any authenticated user)
User Interaction: None
Exploitability: High
Exploit Availability: No public exploit; exploitation requires minimal effort
Vulnerability Description
CVE-2025-67255 is a SQL Injection vulnerability affecting dashboard-related functionality in Nagios XI. Certain parameters used to filter or load dashboard content are passed directly to backend database queries without sufficient validation or parameterization.
As a result, user-supplied input can alter the structure and logic of SQL queries executed by the application. This flaw can be exploited by any authenticated user, including accounts with minimal privileges.
Impact
Successful exploitation allows an attacker to interact directly with the Nagios XI database. Depending on database permissions and configuration, this may result in:
- Disclosure of sensitive database records
- Enumeration of users, roles, and permissions
- Exposure of stored credentials or API tokens
- Modification or deletion of monitoring configuration data
- Privilege escalation by manipulating authorization-related records
Given the central role of Nagios XI in infrastructure monitoring, compromise of this system can have downstream security implications across the environment.
Exploitation Details
An attacker first authenticates to the Nagios XI web interface. The attacker then issues crafted requests to vulnerable dashboard endpoints, supplying malicious input through parameters that are incorporated into SQL queries.
Because input filtering is insufficient, injected SQL syntax is interpreted by the database engine. This allows the attacker to influence query behavior, extract data, or cause database errors used to infer internal structure.
The vulnerability does not require social engineering, race conditions, or elevated privileges.
Detection and Monitoring
Relevant Log Sources
- Web server access logs hosting Nagios XI
- Nagios XI application logs
- Database error and slow query logs
Example Indicators in Logs
The following request characteristics should be treated as suspicious when observed in dashboard-related traffic:
- Unexpected single quotes or double quotes in parameters
- SQL keywords appearing in request values
- Inline or block comment markers
- Time delays between request and response without network cause
Example Suspicious Request Patterns
These examples illustrate patterns, not full exploits:
- Parameters containing logical conditions appended to expected values
- UNION-style query fragments appearing in request parameters
- Database delay functions embedded in user input
- Comment markers used to truncate legitimate SQL logic
Any occurrence of these patterns in dashboard requests warrants investigation.
Detection Rules (Conceptual)
- Alert when dashboard parameters contain SQL metacharacters such as quotes, comments, or operators
- Trigger alerts on repeated database syntax errors tied to dashboard requests
- Identify abnormal response times associated with authenticated dashboard activity
- Correlate SQL errors with specific user sessions and IP addresses
MITRE ATT&CK Mapping
- T1190 – Exploit Public-Facing Application
- T1059 – Command and Scripting Interpreter (via database abuse)
- T1068 – Privilege Escalation
Remediation
The issue has been resolved in an official Nagios XI update that introduces improved input validation and safer database query handling. All affected systems should be upgraded using the official Nagios XI patching process without delay.
CVE-2025-67254
Product: Nagios XI
Affected Version: 2026R1.0.1 (Build 1762361101)
Vulnerability Type: Directory Traversal
CVSS v3.1 Score: 7.5
Severity: High
Attack Vector: Network
Authentication Required: Yes
User Interaction: None
Exploitability: High
Exploit Availability: No public exploit; easily reproducible
Vulnerability Description
CVE-2025-67254 is a directory traversal vulnerability in the Nagios XI administrative endpoint /admin/coreconfigsnapshots.php. The application does not adequately restrict or normalize file path parameters supplied by the user.
This allows authenticated attackers to manipulate file paths and access files outside the intended snapshot directory.
Impact
Exploitation of this vulnerability can expose sensitive files, including:
- Configuration snapshot archives
- Nagios XI configuration files
- Embedded credentials or authentication tokens
- Internal directory structure and file paths
- Potentially system-level files, depending on permissions
Access to configuration snapshots is particularly sensitive, as they often contain operational and security-critical data.
Exploitation Details
After authenticating, an attacker sends a crafted request to the vulnerable endpoint. By inserting directory traversal sequences into file-related parameters, the attacker forces the application to resolve file paths beyond the approved directory.
The server processes the request without enforcing directory boundaries and returns the requested file content if accessible.
Detection and Monitoring
Relevant Log Sources
- Web server access logs
- PHP application error logs
- Operating system file access and audit logs
Example Indicators in Logs
Security teams should look for:
- Requests containing directory traversal sequences
- Repeated access attempts to the snapshot management endpoint
- Requests referencing unexpected directories or file extensions
- File access events tied to authenticated web sessions
Example Traversal Patterns to Detect
These patterns are commonly used during traversal attempts:
- Relative path indicators repeated multiple times
- URL-encoded path traversal characters
- Attempts to access parent directories or system paths
These patterns are not expected in normal snapshot management activity.
Detection Rules (Conceptual)
- Flag any request to
coreconfigsnapshots.phpcontaining relative path sequences - Alert on access to files outside the expected snapshot directory
- Monitor excessive or abnormal access to administrative endpoints
- Correlate file access events with specific user accounts and IP addresses
MITRE ATT&CK Mapping
- T1005 – Data from Local System
- T1083 – File and Directory Discovery
- T1190 – Exploit Public-Facing Application
Remediation
Nagios has addressed this issue in an official update by enforcing strict file path validation and restricting snapshot file access. All affected systems should be updated using the official Nagios XI update mechanism.
Final Assessment
Both vulnerabilities are high-risk due to low exploitation complexity and the sensitive nature of Nagios XI deployments. Organizations should prioritize patching, increase monitoring around authenticated activity, and review access controls to administrative endpoints.
