Sql injection

2023-12-2217:15:00

PRIOn knowledge base

www.prio-n.com

cacti

snmp

blind sql injection

managers.php

operational monitoring

fault management

version 1.2.25

http

crafted request

authenticated attacker

settings/utilities

endpoint

selected_graphs_array

nvd

publication

patched versions

8 High

AI Score

Confidence

Low

0.001 Low

EPSS

Percentile

42.9%

JSON

Cacti provides an operational monitoring and fault management framework. Version 1.2.25 has a Blind SQL Injection (SQLi) vulnerability within the SNMP Notification Receivers feature in the file ‘managers.php’. An authenticated attacker with the “Settings/Utilities” permission can send a crafted HTTP GET request to the endpoint ‘/cacti/managers.php’ with an SQLi payload in the ‘selected_graphs_array’ HTTP GET parameter. As of time of publication, no patched versions exist.