(#Several vulnerabilities have been identified in Centreon :#- stored cross-site scripting. A remote attacker can exploit it in order to execute arbitrary Javascript or HTML code. This vulnerability stems from the non-sanitation of "img_comment" parameter#- command injection. A remote attacker could exploit it in order to inject and execute arbitrary commands. This vulnerability stems from the improper sanitation of "persistant" parameter#- unrestricted file upload vulnerability. A remote attacker could exploit by uploading a malicious PHP script file that will be stored in the "/img/media/" directory it in order to execute arbitrary PHP code#- cross-site request forgery. A remote attacker could perform certain operations with the privileges of their victim by inciting them into opening a malicious link.##Proofs of concept are available.)
