Cacti vulnerabilities

In auth_login.php in Cacti before 1.0.0, remote authenticated users can bypass intended access restrictions by logging in as a user not in the Cacti database, because the guest user is not considered.

Cacti before 1.0.0 allows remote authenticated users to conduct PHP object injection attacks and execute arbitrary PHP code via a crafted serialized object.

Cacti version 1.1.27 allows remote authenticated administrators to conduct Remote Code Execution attacks by placing the Log Path under the web root and then making a remote_agent.php request containing PHP code in a Client-ip header.

In Cacti 1.1.27, the lib/rrd.php file allows remote authenticated administrators to execute arbitrary OS commands via the path_rrdtool parameter in an action=save request to settings.php.

CVE-2017-1000031 is an SQL injection vulnerability in graph_templates_inputs.php in Cacti 0.8.8b that allows remote attackers to execute arbitrary SQL commands via the graph_template_input_id and graph_template_id parameters.

The auth_login.php file in Cacti before version 0.8.8g allows remote authenticated users who use web authentication to bypass intended access restrictions by logging in as a user not in the Cacti database.

SQL injection vulnerability in graph_view.php in Cacti 0.8.8.g allows remote authenticated users to execute arbitrary SQL commands via the host_group_data parameter.

SQL injection vulnerability in the get_hash_graph_template function in lib/functions.php in Cacti before version 0.8.8d allows remote attackers to execute arbitrary SQL commands via the graph_template_id parameter to graph_templates.php.

SQL injection vulnerability in Cacti before version 0.8.8d allows remote attackers to execute arbitrary SQL commands via unspecified vectors involving a cdef id.

The lib/rrd.php file in Cacti versions 0.8.7g, 0.8.8b, and earlier contains a vulnerability that allows remote attackers to execute arbitrary commands via shell metacharacters in unspecified parameters.

The spikekill.php file in Cacti before version 1.1.16 may allow remote attackers to execute arbitrary code via the avgnan, outlier-start, or outlier-end parameter.

Cacti's sanitize_sql_column sanitizes user-supplied ORDER BY column names using a regex that retains letters, digits, underscore, parentheses, and dot. This allows certain payloads to pass through completely unmodified.

In Cacti versions 1.2.30 and prior, a package import signature validation bypass allows self-signed packages. This issue has been fixed in version 1.2.31.

Cacti versions 1.2.30 and prior are vulnerable to Path Traversal via the Report format_file parameter, allowing arbitrary file read. The vulnerability involves two stages: stored injection without validation and subsequent file read using an unsanitized path.

Cacti versions 1.2.30 and prior have an SQL injection vulnerability in managers.php due to unsanitized unserialize and implode operations. The lack of integer validation on deserialized array values allows attackers with SNMP agent management permissions to execute arbitrary SQL commands.

Cacti versions 1.2.30 and prior do not call session_regenerate_id() after successful login, allowing Session Fixation attacks. An attacker can fixate a session and hijack it after the victim logs in.

Cacti versions 1.2.30 and prior are vulnerable to Open Redirect due to using str_contains() for referer checking instead of full host validation. An attacker can craft a malicious Referer header to redirect the user to an attacker-controlled site after login.

Cacti is an open source performance and fault management framework. Versions 1.2.30 and prior are vulnerable to Reflected XSS via tab parameter in the auth_profile.php JavaScript context. This issue has been fixed in version 1.2.31.

Cacti is an open source performance and fault management framework. Versions 1.2.30 and below contain a Reflected XSS vulnerability in the html_auth_footer, which has been fixed in version 1.2.31.

Cacti before 1.2.6 allows IDOR (Insecure Direct Object Reference) for accessing any graph via a modified local_graph_id parameter to graph_xport.php.