Cacti 1.2.24 - Authenticated command injection when using SNMP options Vulnerability

Exploit Title: Cacti 1.2.24 - Authenticated command injection when using SNMP options Exploit Author: Antonio Francesco Sardella Vendor Homepage: https://www.cacti.net/ Software Link: https://www.cacti.net/info/downloads Version: Cacti 1.2.24 Tested on: Cacti 1.2.24 installed on 'php:7.4.33-apach...

Cacti 1.2.24 - Authenticated command injection when using SNMP options

Exploit Title: Cacti 1.2.24 - Authenticated command injection when using SNMP options Date: 2023-07-03 Exploit Author: Antonio Francesco Sardella Vendor Homepage: https://www.cacti.net/ Software Link: https://www.cacti.net/info/downloads Version: Cacti 1.2.24 Tested on: Cacti 1.2.24 installed on...

Amazon Linux AMI : cacti (ALAS-2023-1842)

The version of cacti installed on the remote host is prior to 1.1.19-4.22. It is, therefore, affected by a vulnerability as referenced in the ALAS-2023-1842 advisory. Cacti is an open source operational monitoring and fault management framework. A defect in the sqlsave function was discovered. Wh...

Cacti graph_view SQL Injection Authentication Bypass Vulnerability

This vulnerability allows remote attackers to bypass authentication or escalate privileges on affected installations of Cacti. Authentication is required to exploit this vulnerability when the product is in its default configuration. The specific flaw exists within the graphview endpoint. The iss...

Cacti link Local File Inclusion Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Cacti. Authentication is required to exploit this vulnerability. The specific flaw exists within the link endpoint. The issue results from the lack of proper validation of data retrieved from the...

Important: cacti

Issue Overview: Cacti is an open source operational monitoring and fault management framework. A defect in the sqlsave function was discovered. When the column type is numeric, the sqlsave function directly utilizes user input. Many files and functions calling the sqlsave function do not perform...

OPENSUSE-SU-2023:0275-1 Security update for cacti, cacti-spine

This update for cacti, cacti-spine fixes the following issues: cacti-spine 1.2.25: Spine should see if script to be executed is executable Enhance number recognition When polling devices, sort by larger number of items first Log format may be corrupted when timeout occurs Compile warning appears...

The vulnerability of the reports_user.php component of the Cacti network monitoring software allows a malicious individual to escalate their privileges and execute arbitrary code.

The vulnerability of the reportsuser.php component of the Cacti network monitoring software is related to the lack of validation for the sequences of XML objects. Exploiting this vulnerability can allow a malicious actor to increase their privileges and execute arbitrary code...

The vulnerability of the data_sources.php component of the Cacti network monitoring software lies in the lack of security measures for the website structure. This allows attackers to execute XSS attacks.

The vulnerability of the datasources.php component in the Cacti network monitoring software is related to the lack of protective measures for the website structure. Exploiting this vulnerability allows a malicious actor to carry out XSS attacks remotely...

The vulnerability of the Cacti network monitoring software lies in the lack of authentication for critical functions, allowing attackers to escalate their privileges.

The vulnerability of the Cacti network monitoring software is related to the lack of authentication for critical functions. Exploiting this vulnerability can allow attackers to increase their privileges...

The vulnerability of the auth_changepassword.php component of the Cacti network monitoring software allows a hacker to redirect users to any arbitrary URL address.

The vulnerability of the authchangepassword.php component of the Cacti network monitoring software is related to the use of open redirection. Exploiting this vulnerability allows a malicious actor to redirect a user to an arbitrary URL address...

The vulnerability of the cacti_ldap_auth() function in the network monitoring software Cacti allows a hacker to bypass the authentication process.

The vulnerability of the cactildapauth function in the network monitoring software Cacti is related to authentication errors. Exploiting this vulnerability can allow a malicious actor to bypass the authentication process...

The vulnerability of the reports_admin.php component in the Cacti network monitoring software allows a malicious attacker to execute XSS attacks remotely.

The vulnerability of the reportsadmin.php component in the Cacti network monitoring software, a database management system from Oracle, is related to the lack of security measures taken to protect the structure of the web page. Exploiting this vulnerability allows an attacker to perform XSS attac...

The vulnerability of the sql_save function in the Cacti network monitoring software exists due to insufficient validation of input data, allowing attackers to carry out attacks based on SQL injections.

The vulnerability of the sqlsave function in the Cacti network monitoring software exists due to insufficient validation of input data. Exploiting this vulnerability could allow a malicious actor to carry out attacks based on SQL injections...

The vulnerability of the graphs_new.php component in the Cacti network monitoring software allows a hacker to perform cross-site scripting attacks.

The vulnerability of the graphsnew.php component in the Cacti network monitoring software is related to the lack of security measures taken to protect the structure of the web page. Exploiting this vulnerability could allow a malicious actor to perform cross-site scripting attacks remotely...

The vulnerability of the snmp.php component of the Cacti network monitoring software allows a attacker to execute any command.

The vulnerability of the snmp.php component of the Cacti network monitoring software is related to insufficient checking of arguments passed in commands. Exploiting this vulnerability allows a malicious actor to execute arbitrary commands remotely...

The vulnerability of the “links” function in the Cacti network monitoring software allows a hacker to execute arbitrary SQL queries.

The vulnerability of the “links” function in the Cacti network monitoring software is related to the lack of validation for the sequences of XML objects. Exploiting this vulnerability allows a malicious actor to execute arbitrary SQL queries remotely...

The vulnerability of the graph_xport.php component of the Cacti network monitoring software allows a malicious actor to gain unauthorized access to protected information.

The vulnerability of the graphxport.php component of the Cacti network monitoring software is related to an error in the handling of authentication keys controlled by users. Exploiting this vulnerability can allow a malicious actor, operating remotely, to gain unauthorized access to protected...

The vulnerability of the auth_changepassword.php component of the Cacti network monitoring software allows a attacker to perform XSS attacks.

The vulnerability of the authchangepassword.php component of the Cacti network monitoring software is related to the lack of security measures taken to protect the structure of the web page. Exploiting this vulnerability allows a malicious actor to carry out XSS attacks remotely...

Security update for cacti, cacti-spine (important)

openSUSE Security Update: Security update for cacti, cacti-spine Announcement ID: openSUSE-SU-2023:0275-1 Rating: important References: 1215040 1215042 1215043 1215044 1215045 1215047 1215050 1215051 1215052 1215053 1215054 1215055 1215056 1215058 1215059 1215081 1215082 Cross-References:...