Centreon Open Tickets CVE-2025-12514

Requires an authenticated Centreon user holding ELEVATED (administrative) privileges within the Infra Monitoring Open-tickets module - this is the primary limiting factor and matches CVSS PR:H. The specific injection points are the Notification rules configuration parameters and the Open tickets module inputs, so the Open-tickets module must be installed and in use. Exploitation is remote over the network (AV:N) with no user interaction (UI:N) and low complexity, but only affects versions 24.10.0-24.10.4, 24.04.0-24.04.4, and 23.10.0-23.10.3; patched builds (24.10.5 / 24.04.5 / 23.10.4) remove the exposure. No special non-default configuration beyond having the module and a privileged account is required.

This is a genuine but bounded risk. The CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N/S:U) and the description agree: exploitation is network-reachable with low complexity and no user interaction, but it requires PR:H - an attacker already holding elevated/administrative privileges within the Centreon Open-tickets application. All signals are internally consistent (no CVSS-vs-description conflict). The high-privilege prerequisite is why the base score caps at 7.2 (High) rather than Critical despite full C:H/I:H/A:H impact. Supporting signals point to LOW real-world urgency: EPSS is only 0.31% (23rd percentile), the CVE is NOT in CISA KEV, and no public exploit code or POC is referenced. There is no SSVC decision data in the input. Net: this is a credible privilege-escalation/post-authentication data-compromise issue to patch on a normal cycle, not an emergency - the elevated-privilege barrier and absence of any exploitation evidence sharply reduce the practical attacker population compared with an unauthenticated SQLi.

An authenticated Centreon operator with elevated privileges navigates to the Open-tickets notification rules configuration and submits crafted input into a vulnerable module parameter, injecting SQL that the backend executes. This lets them read, modify, or destroy arbitrary database contents (C:H/I:H/A:H), potentially extracting credentials or monitoring data for lateral movement. No public exploit code is identified at time of analysis, and the network-accessible, low-complexity vector means a malicious insider or an attacker who has already compromised a privileged account could trigger it reliably.