CVE-2020-8813-Cacti-RCE-in-graph_realtime

CVE-2020-8813 - Cacti 1.2.8의 graphrealtime.php를 통한 RCE 기능 Cacti 1.2.8의 graphrealtime.php를 통한 RCE 라이브 모드 단일 명령 실행 상세Verbose 모드 설명 Cacti 1.2.8에서 graphrealtime.php 스크립트는 게스트 사용자에게 그래프 실시간 권한이 부여된 경우, 쿠키에 셸 메타문자를 주입하여 원격 공격자가 임의의 운영 체제 명령을 실행할 수 있도록 허용합니다. 사용법 $ ./CVE-2020-8813.py -h PoC of...

OS Command Injection

cacti:buster is vulnerable to OS Command Injection. The vulnerability exists in graphrealtime.php which allows remote attackers to execute arbitrary commands through shell metacharacters in a cookie...

Cacti v1.2.8 - Unauthenticated Remote Code Execution (Metasploit)

Exploit Title: Cacti v1.2.8 - Unauthenticated Remote Code Execution Metasploit Date: 2020-02-29 Exploit Author: Lucas Amorim sh286s CVE: CVE-2020-8813 Vendor Homepage: https://cacti.net/ Version: v1.2.8 Tested on: Linux This module requires Metasploit: https://metasploit.com/download Current...

CVE-2020-8813

graphrealtime.php in Cacti 1.2.8 allows remote attackers to execute arbitrary OS commands via shell metacharacters in a cookie, if a guest user has the graph real-time privilege...

CVE-2020-8813: Improper Neutralization of Special Elements used in an OS Command

graphrealtime.php in Cacti 1.2.8 allows remote attackers to execute arbitrary OS commands via shell metacharacters in a cookie, if a guest user has the graph real-time privilege...

CVE-2020-8813

graphrealtime.php in Cacti 1.2.8 allows remote attackers to execute arbitrary OS commands via shell metacharacters in a cookie, if a guest user has the graph real-time privilege...