PT-2023-5424 · Cacti+1 · Cacti+1
X4Vak
·
Published
2023-09-05
·
Updated
2024-06-15
·
CVE-2023-39357
CVSS v2.0
9.0
High
| Vector | AV:N/AC:L/Au:S/C:C/I:C/A:C |
Name of the Vulnerable Software and Affected Versions
Cacti versions prior to 1.2.25
Description
A defect in the
sql save function was discovered in Cacti, an open source operational monitoring and fault management framework. When the column type is numeric, the sql save function directly utilizes user input. Many files and functions calling the sql save function do not perform prior validation of user input, leading to the existence of multiple SQL injection vulnerabilities. This allows authenticated users to exploit these SQL injection vulnerabilities to perform privilege escalation and remote code execution.Recommendations
For versions prior to 1.2.25, upgrade to version 1.2.25 or later to address the issue. As a temporary workaround, consider disabling the
sql save function until a patch is available. Restrict access to the vulnerable functions and files that call the sql save function to minimize the risk of exploitation. Avoid using the sql save function with numeric column types until the issue is resolved.Exploit
Fix
RCE
SQL injection
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Alt Linux
Cacti