PT-2015-7780 · Cacti+1 · Cacti+1

Xiaotian.Wang · Published 2015-12-15 · Updated 2024-06-15 · CVE-2015-8377

Positive Technologies (AI Summary)

CVSS v2.0

6.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Cacti versions 0.8.8f and earlier

Description The issue allows remote authenticated users to execute arbitrary SQL commands. This is achieved by sending crafted serialized data in the selected graphs array parameter in a save action, exploiting the host new graphs save function in graphs new.php.

Recommendations For versions 0.8.8f and earlier, update to a version that contains a fix for this issue. As a temporary workaround, consider restricting access to the host new graphs save function in graphs new.php to minimize the risk of exploitation. Avoid using the selected graphs array parameter in the affected save action until the issue is resolved.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

ALT-PU-2016-1467

CVE-2015-8377

DLA-374-1

DSA-3494-1

MGASA-2016-0025

OPENSUSE-SU-2024:10084-1

Affected Products

Alt Linux

Cacti

References · 86

• 🔥 http://seclists.org/fulldisclosure/2015/Dec/57 · Exploit
• https://osv.dev/vulnerability/DSA-3494-1 · Vendor Advisory
• https://security-tracker.debian.org/tracker/DSA-3494-1 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4002 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2024:10084-1 · Vendor Advisory
• https://bdu.fstec.ru/vul/2016-01051 · Security Note
• https://errata.altlinux.org/ALT-PU-2016-1467 · Vendor Advisory
• https://ubuntu.com/security/CVE-2015-8377 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-5261 · Security Note
• https://osv.dev/vulnerability/CVE-2015-8377 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2016-0025 · Vendor Advisory
• https://security-tracker.debian.org/tracker/source-package/cacti · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5588 · Security Note
• https://debian.org/security/2015/dsa-3423 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-4634 · Security Note