Centreon version 2.6.1 suffers from a command injection vulnerability. The POST parameter ‘persistant’ which serves for making a new service run in the background is not properly sanitized before being used to execute commands. This can be exploited to inject and execute arbitrary shell commands as well as using cross site request forgery attacks.