CVE-2020-13252: 
PHP vulnerability analysis and mitigation

Centreon before version 19.04.15 contains a remote code execution vulnerability (CVE-2020-13252) that allows authenticated attackers to execute arbitrary OS commands. The vulnerability exists in the RRDdatabase_status_path parameter that can be exploited via a main.get.php request followed by accessing the include/views/graphs/graphStatus/displayServiceStatus.php page (CVE Details, Centreon GitHub).

The vulnerability stems from improper input validation in the RRDdatabase_status_path parameter. An attacker can inject shell metacharacters into this parameter through the application's web interface. The exploitation involves sending a specially crafted request to main.get.php with the manipulated RRDdatabase_status_path value, followed by triggering the execution through the displayServiceStatus.php page which uses the popen() function to execute commands (Security Blog).

When successfully exploited, this vulnerability allows authenticated attackers to execute arbitrary operating system commands on the underlying server with the privileges of the web application. This could lead to complete system compromise, including the ability to read sensitive files, modify system configurations, and potentially gain persistent access to the server (CVE Details).

The vulnerability requires valid authentication credentials to exploit. A proof-of-concept exploit has been publicly documented that demonstrates how an authenticated user can inject shell commands through the RRDdatabase_status_path parameter and achieve remote code execution. The exploit involves manipulating specific application parameters and triggering the execution through a sequence of HTTP requests (Security Blog).

The vulnerability has been patched in Centreon version 19.04.15. Organizations using affected versions should upgrade to version 19.04.15 or later to mitigate this vulnerability. The fix was implemented through proper input validation and sanitization of the RRDdatabase_status_path parameter (Centreon GitHub).