CrowdSecLive Exploit Tracker
Limited ExploitationCVE-2023-48084Public Exploit

Nagios XI - SQLi (CVE-2023-48084)

PublishedDec 14, 2023
First SeenApr 7, 2025
Last Seen
Reported
CVSS9.8
N
NagiosNagios
web_applicationenterprise_software

Description

Nagios XI before version 5.11.3 was discovered to contain a SQL injection vulnerability via the bulk modification tool.

psychologyCrowdSec Analysis

CVE-2023-48084 is a critical vulnerability affecting Nagios XI, where improper input handling in an administrative interface leads to SQL injection through the bulk modification tool.

CrowdSec has been tracking this vulnerability and its exploits since 7th of April 2025.

Insights from the CrowdSec network reveal that the attackers trying to exploit CVE-2023-48084 are composed of a fairly even mix of opportunistic and targeted actors. Some attackers employ preliminary reconnaissance, while others use indiscriminate scanning. CrowdSec data also reveals a clear uptick in attacks involving CVE-2023-48084 over the past week. Activity is above the usual baseline, suggesting growing attention from attackers. This may reflect rising awareness, recent exploit releases, or expanded targeting efforts.

Observed exploitation attempts often involve requests targeting URLs matching /nagiosxi/index.php/admin/banner_message-ajaxhelper.php.

lock

Full Intelligence Available

Connect your API key to access CrowdSec scores, exploit timelines, and attacker IPs.

EventDate
CVE Published2023-12-14
Rule Released2025-04-07
CrowdSec First Seen2025-04-07

Related Weaknesses

CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.

arrow_forward

Remediation & Protection

lock to download blocklists, subscribe to firewalls, and access IP intelligence.

External References