PT-2005-3080 · Cacti · Cacti

Stefan Esser · Publicado 2005-07-06 · Atualizado 2017-07-11 · CVE-2005-2148

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions: Cacti versions 0.8.6e and earlier

Description: The issue allows remote attackers to execute arbitrary commands or SQL by sending a legitimate value in a POST request or cookie, then specifying the attack string in the URL. This is due to improper input validation, which causes the get request var function to return the wrong value in the $ REQUEST variable. The original malicious $ GET value remains unmodified. This can be demonstrated in files such as graph image.php and graph.php.

Recommendations: For Cacti versions 0.8.6e and earlier, update to a version that properly validates input to prevent common attacks. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Identificadores relacionados

CVE-2005-2148

DSA-764-1

Produtos afetados

Cacti

Referências · 19

• https://exchange.xforce.ibmcloud.com/vulnerabilities/21266 · Nota
• http://debian.org/security/2005/dsa-764 · Aviso do Fabricante
• http://securitytracker.com/id?1014361 · Nota
• https://osv.dev/vulnerability/DEBIAN-CVE-2005-2148 · Aviso do Fabricante
• http://cacti.net/downloads/patches/0.8.6e/cacti-0.8.6f_security.patch · Correção
• http://securityfocus.com/archive/1/404047/30/30/threaded · Nota
• http://securityfocus.com/bid/14128 · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-2148 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2005-2148 · Nota de Segurança
• http://hardened-php.net/advisory-032005.php · Aviso do Fabricante
• https://security-tracker.debian.org/tracker/CVE-2005-2148 · Aviso do Fabricante
• https://exchange.xforce.ibmcloud.com/vulnerabilities/21270 · Nota
• http://securityfocus.com/archive/1/404054 · Nota
• http://secunia.com/advisories/15490 · Nota
• https://osv.dev/vulnerability/CVE-2005-2148 · Aviso do Fabricante