CVE-2015-8604

High

Published: 11/04/2016(UTC)Translated: 15/06/2026(UTC)NVD NIST

Summary

The host_new_graphs function in graphs_new.php in Cacti 0.8.8f and earlier has an SQL injection vulnerability that allows remote authenticated users to execute arbitrary SQL commands via the cg_g parameter in a save action.

Risk Assessment

This vulnerability could lead to unauthorized access to the database, potentially resulting in the exposure or modification of sensitive data within the system.

Recommendation

It is recommended to update Cacti to the latest version to mitigate this vulnerability and to restrict access to the save function to trusted users only.

Other vulnerabilities in Cacti 0.8.8f i wcześniejsze

CVE-2015-8369High
CVE-2015-8369 is an SQL injection vulnerability in include/top_graph_header.php in Cacti version 0.8.8f and earlier. It allows remote attackers to execute arbitrary SQL commands via the rra_id parameter in a properties action to graph.php.

Original NVD description (English source)

SQL injection vulnerability in the host_new_graphs function in graphs_new.php in Cacti 0.8.8f and earlier allows remote authenticated users to execute arbitrary SQL commands via the cg_g parameter in a save action.