PHP file inclusion vulnerability in top_graph_header.php in Cacti 0.8.6d and possibly earlier versions allows remote attackers to execute arbitrary PHP code via the config[library_path] parameter.

According to its self-reported version number, the Cacti application running on the remote web server is prior to version 0.8.6e. It is, therefore, potentially affected by the following vulnerabilities :

  - A PHP file inclusion vulnerability exists in     'top_graph_header.php' that allows remote attackers to     execute arbitrary PHP code using the     'config[library_path]' parameter. (CVE-2005-1524)

  - A SQLi vulnerability exists in 'config_settings.php'     that allows remote attackers to execute arbitrary SQL     commands using the 'id' parameter. (CVE-2005-1525)

  - A PHP remote file inclusion vulnerability exists in     'config_settings.php' that allows remote attackers to     execute arbitrary PHP code using the     'config[include_path]' parameter. (CVE-2005-1526)

Several vulnerabilities have been discovered in cacti, a round-robin database (RRD) tool that helps create graphs from database information. The Common Vulnerabilities and Exposures Project identifies the following problems :

  - CAN-2005-1524     Maciej Piotr Falkiewicz and an anonymous researcher     discovered an input validation bug that allows an     attacker to include arbitrary PHP code from remote sites     which will allow the execution of arbitrary code on the     server running cacti.

  - CAN-2005-1525

    Due to missing input validation cacti allows a remote     attacker to insert arbitrary SQL statements.

  - CAN-2005-1526

    Maciej Piotr Falkiewicz discovered an input validation     bug that allows an attacker to include arbitrary PHP     code from remote sites which will allow the execution of     arbitrary code on the server running cacti.

  - CAN-2005-2148

    Stefan Esser discovered that the update for the above     mentioned vulnerabilities does not perform proper input     validation to protect against common attacks.

  - CAN-2005-2149

    Stefan Esser discovered that the update for     CAN-2005-1525 allows remote attackers to modify session     information to gain privileges and disable the use of     addslashes to protect against SQL injection.

The remote host is affected by the vulnerability described in GLSA-200506-20 (Cacti: Several vulnerabilities)

    Cacti fails to properly sanitize input which can lead to SQL injection,     authentication bypass as well as PHP file inclusion.
  Impact :

    An attacker could potentially exploit the file inclusion to execute     arbitrary code with the permissions of the web server. An attacker     could exploit these vulnerabilities to bypass authentication or inject     SQL queries to gain information from the database. Only systems with     register_globals set to 'On' are affected by the file inclusion and     authentication bypass vulnerabilities. Gentoo Linux ships with     register_globals set to 'Off' by default.
  Workaround :

    There is no known workaround at this time.

The Cacti application running on the remote web server is affected by a local file inclusion vulnerability due to improperly validating user-supplied input to the 'config[include_path]' parameter in 'config_settings.php'. A remote attacker can exploit this to execute arbitrary PHP code.

ID	Name	Product	Family	Type	Severity
81601	Cacti < 0.8.6e Multiple Vulnerabilities	Nessus	CGI abuses	Remote	high
19258	Debian DSA-764-1 : cacti - several vulnerabilities	Nessus	Debian Local Security Checks	Local	critical
18547	GLSA-200506-20 : Cacti: Several vulnerabilities	Nessus	Gentoo Local Security Checks	Local	high
18546	Cacti Local File Inclusion Vulnerability	Nessus	CGI abuses	Remote	high

Detections

Analytics

CVE-2005-1524

critical

Tenable Plugins

high

critical

high

high