CVE-2024-29895

Cacti provides an operational monitoring and fault management framework. A
command injection vulnerability on the 1.3.x DEV branch allows any
unauthenticated user to execute arbitrary command on the server when
register_argc_argv option of PHP is On. In cmd_realtime.php line 119,
the $poller_id used as part of the command execution is sourced from
$_SERVER['argv'], which can be controlled by URL when
register_argc_argv option of PHP is On. And this option is On by
default in many environments such as the main PHP Docker image for PHP.
Commit 53e8014d1f082034e0646edc6286cde3800c683d contains a patch for the
issue, but this commit was reverted in commit
99633903cad0de5ace636249de16f77e57a3c8fc.