Description

An issue was discovered in LibreNMS 1.65. A remote authenticated attacker with normal privileges can extract all the information from the LibreNMS database via a SQL injection in the searchPhrase parameter in the /ajax_table.php API endpoint. This affects as-selection.inc.php, edit-ports.inc.php, alertlog-stats.inc.php, alerts.inc.php, eventlog.inc.php, inventory.inc.php, ix-list.inc.php, ix-peers.inc.php, mempool-edit.inc.php, mempool.inc.php, poll-log.inc.php, processor-edit.inc.php, processor.inc.php, routing-edit.inc.php, sensors-common.inc.php, storage-edit.inc.php, storage.inc.php, and toner.inc.php (in includes/html/table). NOTE: some sources refer to this as CVE-2020-15876, but CVE-2020-15875 is the only correct CVE ID.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.0",
  "pubDate": "2026-09-13T19:16:51.627Z",
  "pubdate": "2026-09-13T19:16:51.627Z",
  "executiveSummary": "A critical SQL injection vulnerability has been identified in LibreNMS version 1.65, specifically affecting the /ajax_table.php API endpoint. This vulnerability allows an authenticated attacker with normal user privileges to manipulate backend database queries, potentially leading to unauthorized data extraction.\nThe flaw stems from insufficient input validation of the searchPhrase parameter across multiple PHP files located in the includes/html/table directory. Successful exploitation grants an attacker the capability to execute arbitrary SQL commands against the underlying database, compromising the confidentiality and integrity of the entire system's stored information.\nThis vulnerability is tracked under CVE-2020-15875. The risk is significant, as it enables lateral movement and data exfiltration within an enterprise network environment where LibreNMS is deployed. The exploitation requires the attacker to possess a valid, albeit low-privileged, user account, making it a serious concern for environments with multiple users or shared access.",
  "technicalDetails": "The vulnerability originates from the improper handling of the searchPhrase parameter in the /ajax_table.php endpoint. The application fails to adequately sanitize or parameterize user-supplied input before incorporating it into database queries within several files in the includes/html/table directory, including as-selection.inc.php, edit-ports.inc.php, alertlog-stats.inc.php, alerts.inc.php, eventlog.inc.php, inventory.inc.php, ix-list.inc.php, ix-peers.inc.php, mempool-edit.inc.php, mempool.inc.php, poll-log.inc.php, processor-edit.inc.php, processor.inc.php, routing-edit.inc.php, sensors-common.inc.php, storage-edit.inc.php, storage.inc.php, and toner.inc.php.\nExploitation is achieved through a SQL injection attack vector. Because the application utilizes the searchPhrase parameter as a direct input to dynamic SQL constructs, an attacker can supply specially crafted malicious payloads containing SQL control characters, such as single quotes, comments, or UNION operators. By injecting these into the parameter, the attacker can force the database to execute unintended queries, effectively bypassing intended application logic.\nThe attack flow follows a structured pattern: 1) The attacker authenticates as a normal user. 2) The attacker crafts an HTTP request targeting /ajax_table.php, inserting malicious SQL syntax into the searchPhrase parameter. 3) The application’s backend logic processes this parameter within the affected files in includes/html/table. 4) The lack of parameterized queries or strict input filtering allows the malicious payload to terminate or alter the structure of the legitimate SQL command. 5) The database executes the injected command, returning sensitive information from the database schema, including tables, columns, or unauthorized rows, back to the attacker via the application response.\nThe vulnerability is persistent across various functional modules of the LibreNMS dashboard, as indicated by the long list of vulnerable include files. Given that LibreNMS typically runs with database-level permissions that allow it to read and write to all operational tables, the potential for post-exploitation impact is severe. An attacker can perform a full database dump, modify administrative user credentials, or extract system configuration data, leading to full compromise of the monitoring instance and potential pivoting into the wider network infrastructure."
}