Cacti 0.8.6e and earlier does not perform proper input validation to protect against common attacks, which allows remote attackers to execute arbitrary commands or SQL by sending a legitimate value in a POST request or cookie, then specifying the attack string in the URL, which causes the get_request_var function to return the wrong value in the $_REQUEST variable, which is cleansed while the original malicious $_GET value remains unmodified, as demonstrated in (1) graph_image.php and (2) graph.php.

According to its self-reported version number, the Cacti application running on the remote web server is prior to version 0.8.6f. It is, therefore, potentially affected by the following vulnerabilities :

  - Multiple vulnerabilities exist due to improper input     validation in 'graph_image.php' and 'graph.php'.
    (CVE-2005-2148)

  - A flaw exists in 'config.php' that allows remote     attackers to set the 'no_http_headers' switch and then     modify session information in order to gain the     privileges necessary to perform SQL injection attacks.
    (CVE-2005-2149)

Several vulnerabilities have been discovered in cacti, a round-robin database (RRD) tool that helps create graphs from database information. The Common Vulnerabilities and Exposures Project identifies the following problems :

  - CAN-2005-1524     Maciej Piotr Falkiewicz and an anonymous researcher     discovered an input validation bug that allows an     attacker to include arbitrary PHP code from remote sites     which will allow the execution of arbitrary code on the     server running cacti.

  - CAN-2005-1525

    Due to missing input validation cacti allows a remote     attacker to insert arbitrary SQL statements.

  - CAN-2005-1526

    Maciej Piotr Falkiewicz discovered an input validation     bug that allows an attacker to include arbitrary PHP     code from remote sites which will allow the execution of     arbitrary code on the server running cacti.

  - CAN-2005-2148

    Stefan Esser discovered that the update for the above     mentioned vulnerabilities does not perform proper input     validation to protect against common attacks.

  - CAN-2005-2149

    Stefan Esser discovered that the update for     CAN-2005-1525 allows remote attackers to modify session     information to gain privileges and disable the use of     addslashes to protect against SQL injection.

The Cacti application running on the remote web server is affected by an authentication bypass vulnerability.

ID	Name	Product	Family	Type	Severity
81602	Cacti < 0.8.6f Multiple Vulnerabilities	Nessus	CGI abuses	Remote	high
19258	Debian DSA-764-1 : cacti - several vulnerabilities	Nessus	Debian Local Security Checks	Local	critical
18619	Cacti < 0.8.6f Authentication Bypass Vulnerability	Nessus	CGI abuses	Remote	high

Detections

Analytics

CVE-2005-2148

critical

Tenable Plugins

high

critical

high