SQL injection vulnerability in graph.php in Cacti 0.8.7e and earlier allows remote attackers to execute arbitrary SQL commands via a crafted rra_id parameter in a GET request in conjunction with a valid rra_id value in a POST request or a cookie, which causes the POST or cookie value to bypass the validation routine, but inserts the $_GET value into the resulting query.

The remote host is affected by the vulnerability described in GLSA-201401-20 (Cacti: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Cacti. Please review       the CVE identifiers referenced below for details.
  Impact :

    A remote attacker could execute arbitrary SQL commands via specially       crafted parameters, execute arbitrary shell code or inject malicious       script code.
  Workaround :

    There is no known workaround at this time.

Stefan Esser discovered that cacti, a front-end to rrdtool for monitoring systems and services, is not properly validating input passed to the rra_id parameter of the graph.php script. Due to checking the input of $_REQUEST but using $_GET input in a query an unauthenticated attacker is able to perform SQL injections via a crafted rra_id $_GET value and an additional valid rra_id $_POST or $_COOKIE value.

According to its self-reported version number, the Cacti application running on the remote web server is prior to version 0.8.7f. It is, therefore, potentially affected by the following vulnerabilities :

  - A vulnerability exists in 'templates_export.php' due to     improper validation of input to the 'export_item_id'     parameter. A remote attacker can exploit this to inject     SQL queries to disclose arbitrary data. (CVE-2010-1431)

  - Cross-site scripting vulnerabilities exist related to     the 'host_id' parameter of 'data_sources.php', or the     'hostname' and 'description' parameters of 'host.php',     which a remote attacker can exploit to inject arbitrary     web script or HTML. (CVE-2010-1644)

  - A SQL injection vulnerability in 'graph.php' exists     which can be exploited by a remote attacker using     specially crafted GET requests to the 'rra_id' parameter     which can cause a corresponding POST request or cookie     to bypass proper validation. (CVE-2010-2092)

ID	Name	Product	Family	Severity
72075	GLSA-201401-20 : Cacti: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
46875	Debian DSA-2060-1 : cacti - insufficient input sanitization	Nessus	Debian Local Security Checks	high
46222	Cacti < 0.8.7f Multiple Input Validation Vulnerabilities	Nessus	CGI abuses	high

Detections

Analytics

CVE-2010-2092

critical

Tenable Plugins

high

high

high