CVE-2020-15873: 
PHP vulnerability analysis and mitigation

In LibreNMS before version 1.65.1, an authenticated attacker could achieve SQL Injection via the customoid.inc.php device_id POST parameter. The vulnerability was assigned CVE-2020-15873 and was discovered by the ACE Team at Loginsoft (Loginsoft Research).

The vulnerability is classified as CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection'). The issue existed in customoid.inc.php where the device_id POST parameter was not properly sanitized before being used in SQL queries. This allowed for blind SQL injection attacks through carefully crafted POST requests (NVD).

An authenticated attacker could exploit this vulnerability to extract complete database information through blind SQL injection techniques. The attacker could potentially access sensitive information stored in the database by injecting malicious SQL queries (Loginsoft Research).

The vulnerability requires authentication to exploit. A proof-of-concept exploit code was published demonstrating how an authenticated user could extract arbitrary data from the database using Python-based blind SQL injection techniques (Loginsoft Research).

The vulnerability was fixed in LibreNMS version 1.65.1 by implementing parameterized queries. The fix involved changing the SQL query to use prepared statements with proper parameter binding (GitHub Commit).