Cacti vulnerabilities

In auth_login.php in Cacti before 1.0.0, remote authenticated users can bypass intended access restrictions by logging in as a user not in the Cacti database, because the guest user is not considered.

Cacti before 1.0.0 allows remote authenticated users to conduct PHP object injection attacks and execute arbitrary PHP code via a crafted serialized object.

Cacti version 1.1.27 allows remote authenticated administrators to conduct Remote Code Execution attacks by placing the Log Path under the web root and then making a remote_agent.php request containing PHP code in a Client-ip header.

In Cacti 1.1.27, the lib/rrd.php file allows remote authenticated administrators to execute arbitrary OS commands via the path_rrdtool parameter in an action=save request to settings.php.

CVE-2017-1000031 is an SQL injection vulnerability in graph_templates_inputs.php in Cacti 0.8.8b that allows remote attackers to execute arbitrary SQL commands via the graph_template_input_id and graph_template_id parameters.

The auth_login.php file in Cacti before version 0.8.8g allows remote authenticated users who use web authentication to bypass intended access restrictions by logging in as a user not in the Cacti database.

SQL injection vulnerability in graph_view.php in Cacti 0.8.8.g allows remote authenticated users to execute arbitrary SQL commands via the host_group_data parameter.

SQL injection vulnerability in the get_hash_graph_template function in lib/functions.php in Cacti before version 0.8.8d allows remote attackers to execute arbitrary SQL commands via the graph_template_id parameter to graph_templates.php.

SQL injection vulnerability in Cacti before version 0.8.8d allows remote attackers to execute arbitrary SQL commands via unspecified vectors involving a cdef id.

The lib/rrd.php file in Cacti versions 0.8.7g, 0.8.8b, and earlier contains a vulnerability that allows remote attackers to execute arbitrary commands via shell metacharacters in unspecified parameters.

Cacti prior to 1.2.29 has an input-validation flaw in SNMP device configuration. An authenticated user can supply crafted SNMP community strings containing control characters (including newlines) that are accepted, stored verbatim, and later embedded into backend SNMP operations, potentially leading to unintended command execution with Cacti process privileges in certain environments.

The spikekill.php file in Cacti before version 1.1.16 may allow remote attackers to execute arbitrary code via the avgnan, outlier-start, or outlier-end parameter.

Cacti is an open source performance and fault management framework. Prior to version 1.2.31, a user enumeration vulnerability allows an attacker to identify valid usernames on the Cacti service. On login attempts, the application returns slightly different error messages depending on whether the provided username exists — the only difference is the capitalization of the letter "f" in the word "failed".

Cacti contains an authenticated stored second-order SQL injection in the automation tree rule item handler. A user holding the Automation realm (default General Administration role) can persist an arbitrary SQL fragment in the automation_tree_rule_items.field column, which is later concatenated directly into a SELECT ... AS source FROM ... clause in lib/api_automation.php :: create_all_header_nodes() and executed when an administrator triggers automation via the "Apply Automation Rules" bulk action. The injected SELECT result is written into graph_tree_items.title and rendered in the Cacti tree UI, providing a direct exfiltration channel.

In Cacti prior to version 1.2.31, the prior blocklist ([;&| `$\n\r]) omitted single-quote, double-quote, redirect operators, subshell parens and braces. An authenticated admin could save an input_string containing these characters and bypass the check.

Cacti's sanitize_sql_column sanitizes user-supplied ORDER BY column names using a regex that retains letters, digits, underscore, parentheses, and dot. This allows certain payloads to pass through completely unmodified.

In Cacti versions 1.2.30 and prior, a package import signature validation bypass allows self-signed packages. This issue has been fixed in version 1.2.31.

Cacti versions 1.2.30 and prior are vulnerable to Path Traversal via the Report format_file parameter, allowing arbitrary file read. The vulnerability involves two stages: stored injection without validation and subsequent file read using an unsanitized path.

Cacti versions 1.2.30 and prior have an SQL injection vulnerability in managers.php due to unsanitized unserialize and implode operations. The lack of integer validation on deserialized array values allows attackers with SNMP agent management permissions to execute arbitrary SQL commands.

Cacti versions 1.2.30 and prior do not call session_regenerate_id() after successful login, allowing Session Fixation attacks. An attacker can fixate a session and hijack it after the victim logs in.

Cacti versions 1.2.30 and prior are vulnerable to Open Redirect due to using str_contains() for referer checking instead of full host validation. An attacker can craft a malicious Referer header to redirect the user to an attacker-controlled site after login.

Cacti is an open source performance and fault management framework. Versions 1.2.30 and prior are vulnerable to Reflected XSS via tab parameter in the auth_profile.php JavaScript context. This issue has been fixed in version 1.2.31.

Cacti is an open source performance and fault management framework. Versions 1.2.30 and below contain a Reflected XSS vulnerability in the html_auth_footer, which has been fixed in version 1.2.31.

Cacti versions prior to 0.8.6-d contain a remote command execution vulnerability in graph_view.php. An authenticated user can inject arbitrary shell commands via the graph_start GET parameter, which is improperly handled during graph rendering. This allows attackers to execute commands on the OS with web server privileges.

Cacti before 1.2.6 allows IDOR (Insecure Direct Object Reference) for accessing any graph via a modified local_graph_id parameter to graph_xport.php.