1. CVE-Search
  2. CVE-2005-2148
ID CVE-2005-2148
Summary Cacti 0.8.6e and earlier does not perform proper input validation to protect against common attacks, which allows remote attackers to execute arbitrary commands or SQL by sending a legitimate value in a POST request or cookie, then specifying the attack string in the URL, which causes the get_request_var function to return the wrong value in the $_REQUEST variable, which is cleansed while the original malicious $_GET value remains unmodified, as demonstrated in (1) graph_image.php and (2) graph.php.
References
Vulnerable Configurations
  • cpe:2.3:a:the_cacti_group:cacti:0.8:*:*:*:*:*:*:*
    cpe:2.3:a:the_cacti_group:cacti:0.8:*:*:*:*:*:*:*
  • cpe:2.3:a:the_cacti_group:cacti:0.8.1:*:*:*:*:*:*:*
    cpe:2.3:a:the_cacti_group:cacti:0.8.1:*:*:*:*:*:*:*
  • cpe:2.3:a:the_cacti_group:cacti:0.8.2:*:*:*:*:*:*:*
    cpe:2.3:a:the_cacti_group:cacti:0.8.2:*:*:*:*:*:*:*
  • cpe:2.3:a:the_cacti_group:cacti:0.8.2a:*:*:*:*:*:*:*
    cpe:2.3:a:the_cacti_group:cacti:0.8.2a:*:*:*:*:*:*:*
  • cpe:2.3:a:the_cacti_group:cacti:0.8.3:*:*:*:*:*:*:*
    cpe:2.3:a:the_cacti_group:cacti:0.8.3:*:*:*:*:*:*:*
  • cpe:2.3:a:the_cacti_group:cacti:0.8.3a:*:*:*:*:*:*:*
    cpe:2.3:a:the_cacti_group:cacti:0.8.3a:*:*:*:*:*:*:*
  • cpe:2.3:a:the_cacti_group:cacti:0.8.4:*:*:*:*:*:*:*
    cpe:2.3:a:the_cacti_group:cacti:0.8.4:*:*:*:*:*:*:*
  • cpe:2.3:a:the_cacti_group:cacti:0.8.5:*:*:*:*:*:*:*
    cpe:2.3:a:the_cacti_group:cacti:0.8.5:*:*:*:*:*:*:*
  • cpe:2.3:a:the_cacti_group:cacti:0.8.5a:*:*:*:*:*:*:*
    cpe:2.3:a:the_cacti_group:cacti:0.8.5a:*:*:*:*:*:*:*
  • cpe:2.3:a:the_cacti_group:cacti:0.8.6:*:*:*:*:*:*:*
    cpe:2.3:a:the_cacti_group:cacti:0.8.6:*:*:*:*:*:*:*
  • cpe:2.3:a:the_cacti_group:cacti:0.8.6a:*:*:*:*:*:*:*
    cpe:2.3:a:the_cacti_group:cacti:0.8.6a:*:*:*:*:*:*:*
  • cpe:2.3:a:the_cacti_group:cacti:0.8.6b:*:*:*:*:*:*:*
    cpe:2.3:a:the_cacti_group:cacti:0.8.6b:*:*:*:*:*:*:*
  • cpe:2.3:a:the_cacti_group:cacti:0.8.6c:*:*:*:*:*:*:*
    cpe:2.3:a:the_cacti_group:cacti:0.8.6c:*:*:*:*:*:*:*
  • cpe:2.3:a:the_cacti_group:cacti:0.8.6d:*:*:*:*:*:*:*
    cpe:2.3:a:the_cacti_group:cacti:0.8.6d:*:*:*:*:*:*:*
  • cpe:2.3:a:the_cacti_group:cacti:0.8.6e:*:*:*:*:*:*:*
    cpe:2.3:a:the_cacti_group:cacti:0.8.6e:*:*:*:*:*:*:*
CVSS
Base: 7.5 (as of 11-07-2017 - 01:32)
Impact:
Exploitability:
CWE NVD-CWE-Other
CAPEC
Access
VectorComplexityAuthentication
NETWORK LOW NONE
Impact
ConfidentialityIntegrityAvailability
PARTIAL PARTIAL PARTIAL
cvss-vector via4 AV:N/AC:L/Au:N/C:P/I:P/A:P
refmap via4
bid
  • 14128
  • 14129
bugtraq
  • 20050702 Advisory 03/2005: Cacti Multiple SQL Injection Vulnerabilities [FIXED]
  • 20050702 Advisory 04/2005: Cacti Remote Command Execution Vulnerability
confirm http://www.cacti.net/downloads/patches/0.8.6e/cacti-0.8.6f_security.patch
debian DSA-764
misc
mlist [cacti-announce] 20050701 Cacti 0.8.6f Released
sectrack 1014361
secunia 15490
vupen ADV-2005-0951
xf
  • cacti-graph-post-cookie-sql-injection(21266)
  • cacti-request-array-command-execution(21270)
Last major update 11-07-2017 - 01:32
Published 06-07-2005 - 04:00
Last modified 11-07-2017 - 01:32
Back to Top