PT-2021-11829 · Cacti+4 · Cacti+4

Thewitness · Published 2021-01-11 · Updated 2025-01-24 · CVE-2020-35701

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: Cacti versions 1.2.x through 1.2.16

Description: A SQL injection issue in data debug.php allows remote authenticated attackers to execute arbitrary SQL commands via the site id parameter, potentially leading to remote code execution.

Recommendations: For Cacti versions 1.2.x through 1.2.16, as a temporary workaround, consider restricting access to the data debug.php file until a patch is available. Avoid using the site id parameter in the affected endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

RCE

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

ALT-PU-2021-2264

ALT-PU-2025-1813

CVE-2020-35701

OPENSUSE-SU-2021:0755-1

OPENSUSE-SU-2021:0787-1

OPENSUSE-SU-2021_0755-1

OPENSUSE-SU-2024:10670-1

USN-5214-1

Affected Products

Alt Linux

Cacti

Linuxmint

Suse

Ubuntu

References · 82

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/unix/http/cacti_filter_sqli_rce.rb · Exploit
• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/cacti_pollers_sqli_rce.rb · Exploit
• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/cacti_package_import_rce.rb · Exploit
• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/cacti_unauthenticated_cmd_injection.rb · Exploit
• 🔥 https://github.com/mhaskar/CVE-2020-8813 · Exploit
• 🔥 https://github.com/0xf4n9x/CVE-2022-46169 · Exploit
• 🔥 https://github.com/FredBrave/CVE-2022-46169-CACTI-1.2.22 · Exploit
• 🔥 https://github.com/sAsPeCt488/CVE-2022-46169 · Exploit
• 🔥 https://github.com/ariyaadinatha/cacti-cve-2022-46169-exploit · Exploit
• 🔥 https://github.com/botfather0x0/CVE-2022-46169 · Exploit
• 🔥 https://github.com/Anthonyc3rb3ru5/CVE-2022-46169 · Exploit
• 🔥 https://github.com/deadyP00l/CVE-2022-46169 · Exploit
• 🔥 https://github.com/c3rrberu5/CVE-2022-46169 · Exploit
• 🔥 https://github.com/thisisveryfunny/CVE-2024-25641-RCE-Automated-Exploit-Cacti-1.2.26 · Exploit
• 🔥 https://github.com/p0dalirius/CVE-2020-8813-Cacti-RCE-in-graph_realtime · Exploit