CVE-2020-36947: 
PHP vulnerability analysis and mitigation

CVE-2020-36947 is an authenticated SQL injection vulnerability in LibreNMS version 1.46, specifically affecting the MAC accounting graph endpoint. Attackers with valid credentials can manipulate the sort parameter to perform time-based blind SQL injection and extract sensitive database contents. The vulnerability was published on January 27, 2026, and carries a CVSS v3.1 base score of 6.5 (Medium) and a CVSS v4.0 base score of 7.1 (High) (Feedly, VulnCheck Advisory).

The root cause is improper neutralization of special elements in SQL commands (CWE-89), where user-supplied input to the sort parameter in the MAC accounting graph endpoint is not adequately sanitized before being incorporated into database queries. An authenticated attacker can craft malicious SQL payloads — specifically time-based blind SQL injection techniques — to infer database contents character by character based on server response timing. Exploitation requires a valid user account on the LibreNMS instance but no elevated privileges. A public exploit is available on Exploit-DB (Exploit-DB, VulnCheck Advisory).

Successful exploitation allows an authenticated attacker to extract the full contents of the LibreNMS database, which may include credentials, device configurations, SNMP community strings, user account data, and other sensitive network monitoring information. The impact is primarily on confidentiality (rated High), with no direct availability or integrity impact per the CVSS v3.1 scoring. Exposure of SNMP credentials or device management data could facilitate lateral movement into monitored network infrastructure (Feedly).

A public proof-of-concept exploit is available on Exploit-DB (EDB-49246), making this vulnerability accessible to less sophisticated attackers (Exploit-DB). The EPSS score is extremely low at 0.003%, suggesting limited observed exploitation activity in the wild. There is no current listing in the CISA Known Exploited Vulnerabilities (KEV) catalog, and no specific threat actor attribution has been reported. The vulnerability is detectable by Qualys scanner (detection ID 5007310) (Feedly).

1. Reconnaissance: Identify LibreNMS instances running version 1.46 via network scanning or web fingerprinting. Look for the LibreNMS login page and version indicators in HTTP headers or page source.
2. Authentication: Log in to the LibreNMS web interface using any valid low-privileged user account.
3. Locate the vulnerable endpoint: Navigate to the MAC accounting graph endpoint within the LibreNMS web application (typically accessible via the billing/MAC accounting section of the UI).
4. Craft the injection payload: Modify the sort parameter in the HTTP request to include a time-based blind SQL injection payload (e.g., sort=1 AND SLEEP(5)-- or similar DBMS-specific timing payloads).
5. Enumerate the database: Use automated tools such as sqlmap with the authenticated session cookie, targeting the sort parameter, to systematically extract database schema, table names, and sensitive data through timing-based inference.
6. Exfiltrate data: Retrieve sensitive contents such as user credentials, SNMP community strings, and device configurations from the database (Exploit-DB, VulnCheck Advisory).

• Network: Unusual or repeated HTTP requests to the MAC accounting graph endpoint with anomalous sort parameter values containing SQL keywords (e.g., SLEEP, WAITFOR, BENCHMARK, AND, OR, --).
• Logs: LibreNMS web server access logs showing requests to the MAC accounting graph endpoint with encoded or unusual sort parameter values; elevated response times on specific requests suggesting time-based injection.
• Database: Unexpected slow queries in MySQL/MariaDB slow query logs originating from the LibreNMS application user, particularly involving SLEEP() or similar timing functions.
• Application: Multiple sequential requests to the same endpoint from a single authenticated session with incrementally varying sort parameter values, consistent with automated blind SQL injection enumeration.

Users should upgrade LibreNMS beyond version 1.46 to a patched release, as the vulnerability is specific to that version. The LibreNMS project maintains active releases (current latest is 26.5.1 as of May 2026) and users should update to the latest stable version (LibreNMS GitHub). As an interim measure, restrict access to the LibreNMS web interface to trusted IP addresses and enforce strong, unique credentials for all user accounts to reduce the attack surface. Review and audit LibreNMS user accounts to ensure the principle of least privilege is applied.