{"id":"CVE-2019-13024","aliases":["EUVD-2019-4592","GHSA-v39g-xvv3-gr6r"],"status":"published","title":"Centreon V19.04 allows the attacker to execute arbitrary system commands by using the value ...","description":"Centreon 18.x before 18.10.6, 19.x before 19.04.3, and Centreon web before 2.8.29 allows the attacker to execute arbitrary system commands by using the value \"init_script\"-\"Monitoring Engine Binary\" in main.get.php to insert a arbitrary command into the database, and execute it by calling the vulnerable page www/include/configuration/configGenerate/xml/generateFiles.php (which passes the inserted value to the database to shell_exec without sanitizing it, allowing one to execute system arbitrary commands).","severity":{"version":"3.0","score":8.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.31645,"percentile":0.98306,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":false},"cwes":["CWE-77"],"published":"2019-07-01T18:17:05Z","modified":"2026-06-17T02:15:56Z","exploits":[{"source":"exploitdb","id":"EDB-47069","title":"Centreon 19.04 - Remote Code Execution","type":"webapps","platform":"php","date":"2019-07-02","url":"https://www.exploit-db.com/exploits/47069"},{"source":"exploitdb","id":"EDB-52156","title":"Centron 19.04 - Remote Code Execution (RCE)","type":"webapps","platform":"php","date":"2025-04-10","url":"https://www.exploit-db.com/exploits/52156"},{"source":"pocgithub","id":"get-get-get-get/Centreon-RCE","title":"get-get-get-get/Centreon-RCE","date":"2019-11-08","url":"https://github.com/get-get-get-get/Centreon-RCE"},{"source":"pocgithub","id":"mhaskar/CVE-2019-13024","title":"mhaskar/CVE-2019-13024","date":"2019-08-24","url":"https://github.com/mhaskar/CVE-2019-13024"}],"products":[{"vendor":"centreon","product":"centreon"}],"references":[{"url":"https://gist.github.com/mhaskar/c4255f6cf45b19b8a852c780f50576da","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory"]},{"url":"https://shells.systems/centreon-v19-04-remote-code-execution-cve-2019-13024/","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory"]},{"url":"http://packetstormsecurity.com/files/153504/Centreon-19.04-Remote-Code-Execution.html","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory","VDB Entry"]},{"url":"https://github.com/centreon/centreon/pull/7694","tags":["x_refsource_CONFIRM","x_transferred"]},{"url":"https://documentation.centreon.com/docs/centreon/en/latest/release_notes/centreon-19.04/centreon-19.04.3.html","tags":["x_refsource_CONFIRM","x_transferred"]},{"url":"https://documentation.centreon.com/docs/centreon/en/latest/release_notes/centreon-18.10/centreon-18.10.6.html","tags":["x_refsource_CONFIRM","x_transferred"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-13024"},{"url":"https://github.com/advisories/GHSA-v39g-xvv3-gr6r"}],"sources":{"cve":[{"id":"CVE-2019-13024","description":"Centreon 18.x before 18.10.6, 19.x before 19.04.3, and Centreon web before 2.8.29 allows the attacker to execute arbitrary system commands by using the value \"init_script\"-\"Monitoring Engine Binary\" in main.get.php to insert a arbitrary command into the database, and execute it by calling the vulnerable page www/include/configuration/configGenerate/xml/generateFiles.php (which passes the inserted value to the database to shell_exec without sanitizing it, allowing one to execute system arbitrary commands).","status":"published","published":"2019-07-01T18:17:05Z","modified":"2024-08-04T23:41:10.083Z","updated_at":"2026-11-02T14:20:24.025419Z"}],"euvd":[{"id":"EUVD-2019-4592","description":"Centreon 18.x before 18.10.6, 19.x before 19.04.3, and Centreon web before 2.8.29 allows the attacker to execute arbitrary system commands by using the value \"init_script\"-\"Monitoring Engine Binary\" in main.get.php to insert a arbitrary command into the database, and execute it by calling the vulnerable page www/include/configuration/configGenerate/xml/generateFiles.php (which passes the inserted value to the database to shell_exec without sanitizing it, allowing one to execute system arbitrary commands).","status":"published","published":"2019-07-01T18:17:05Z","modified":"2024-08-04T23:41:10Z","updated_at":"2026-11-03T02:40:43.860719Z"}],"ghsa":[{"id":"GHSA-v39g-xvv3-gr6r","title":"Centreon V19.04 allows the attacker to execute arbitrary system commands by using the value ...","description":"Centreon V19.04 allows the attacker to execute arbitrary system commands by using the value \"init_script\"-\"Monitoring Engine Binary\" in main.get.php to insert a arbitrary command into the database, and execute it by calling the vulnerable page www/include/configuration/configGenerate/xml/generateFiles.php (which passes the inserted value to the database to shell_exec without sanitizing it, allowing one to execute system arbitrary commands).","status":"published","published":"2022-05-24T16:49:06Z","modified":"2023-01-28T05:06:16Z","updated_at":"2026-11-02T14:44:25.398405Z"}],"nvd":[{"id":"CVE-2019-13024","description":"Centreon 18.x before 18.10.6, 19.x before 19.04.3, and Centreon web before 2.8.29 allows the attacker to execute arbitrary system commands by using the value \"init_script\"-\"Monitoring Engine Binary\" in main.get.php to insert a arbitrary command into the database, and execute it by calling the vulnerable page www/include/configuration/configGenerate/xml/generateFiles.php (which passes the inserted value to the database to shell_exec without sanitizing it, allowing one to execute system arbitrary commands).","status":"published","published":"2019-07-01T19:15:11.01Z","modified":"2026-06-17T02:15:56.183Z","cvss":[{"version":"3.0","score":8.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":9,"vector":"AV:N/AC:L/Au:S/C:C/I:C/A:C","level":"high","assessor":"primary"}],"cwes":["CWE-77"],"updated_at":"2026-11-02T14:05:17.695191Z"}]}}