CVE-2024-23118: 
PHP vulnerability analysis and mitigation

Centreon updateContactHostCommands SQL Injection Remote Code Execution Vulnerability (CVE-2024-23118) is a security flaw that affects Centreon installations. The vulnerability was discovered in November 2023 and publicly disclosed on February 9, 2024. This vulnerability requires authentication and exists within the updateContactHostCommands function, affecting Centreon-web versions prior to 22.10.15, 23.04.10, and 23.10.1 (Zero Day Initiative).

The vulnerability stems from improper validation of user-supplied strings before their use in SQL query construction within the updateContactHostCommands function. It has been assigned a CVSS v3.0 base score of 7.2 (High), with the vector string CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H. The vulnerability is classified as CWE-89 (SQL Injection) (Zero Day Initiative).

When successfully exploited, this vulnerability allows authenticated remote attackers to execute arbitrary code on affected Centreon installations. The code execution occurs in the context of the service account, potentially giving attackers significant control over the affected system (Zero Day Initiative).

The vulnerability requires authentication to exploit, indicating a somewhat limited attack surface. However, once authenticated, the attack complexity is considered low, requiring no user interaction to execute (Zero Day Initiative).

The vulnerability has been fixed in Centreon-web versions 22.10.15, 23.04.10, and 23.10.1. Users are advised to upgrade to these patched versions to protect against potential exploitation. The fix was implemented through a pull request on the Centreon GitHub repository (Zero Day Initiative).