CVE-2024-32480: 
PHP vulnerability analysis and mitigation

CVE-2024-32480 affects LibreNMS, an open-source PHP/MySQL/SNMP-based network monitoring system. The vulnerability was discovered in versions prior to 24.4.0 and involves a SQL injection vulnerability in the list_devices function. The issue was disclosed and patched in April 2024 (GitHub Advisory).

The vulnerability exists in the list_devices function where the 'order' parameter obtained from $request is improperly validated. After performing a string check, the value is directly incorporated into an SQL statement and concatenated, resulting in a SQL injection vulnerability. The issue has been assigned a CVSS v3.1 base score of 7.2 (HIGH) with the vector string CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H (NVD).

An attacker with valid API token access could exploit this vulnerability to extract the entire database. The vulnerability affects the confidentiality, integrity, and availability of the system, with potential for unauthorized data access and modification (GitHub Advisory).

The vulnerability requires high privileges (valid API token) but is network-accessible with low attack complexity. A proof of concept exploit has been documented that demonstrates the ability to extract database information through time-based blind SQL injection (GitHub Advisory).

The vulnerability has been fixed in LibreNMS version 24.4.0. Users are advised to upgrade to this version or later to mitigate the risk. The fix includes improved order validation in the list_devices function (GitHub Patch).