SQL injection vulnerability in include/top_graph_header.php in Cacti 0.8.8f and earlier allows remote attackers to execute arbitrary SQL commands via the rra_id parameter in a properties action to graph.php.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - SQL injection vulnerability in include/top_graph_header.php in Cacti 0.8.8f and earlier allows remote
    attackers to execute arbitrary SQL commands via the rra_id parameter in a properties action to graph.php.
    (CVE-2015-8369)

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

  - SQL injection vulnerability in include/top_graph_header.php in Cacti 0.8.8f and earlier allows remote
    attackers to execute arbitrary SQL commands via the rra_id parameter in a properties action to graph.php.
    (CVE-2015-8369)

  - SQL injection vulnerability in the host_new_graphs_save function in graphs_new.php in Cacti 0.8.8f and
    earlier allows remote authenticated users to execute arbitrary SQL commands via crafted serialized data in
    the selected_graphs_array parameter in a save action. (CVE-2015-8377)

The remote host is affected by the vulnerability described in GLSA-201607-05 (Cacti: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Cacti. Please review       the CVE identifiers referenced below for details.
  Impact :

    A remote attacker could possibly execute arbitrary code with the       privileges of the process, or remote authenticated users could bypass       intended access restrictions.
  Workaround :

    There is no known workaround at this time.

cacti was updated to fix the following vulnerabilities :

  - CVE-2015-8369: SQL injection in graph.php (boo#958863)

  - CVE-2015-8604: SQL injection in graphs_new.php     (boo#960678)

  - CVE-2015-8377: SQL injection vulnerability in the     host_new_graphs_save function in graphs_new.php     (boo#958977)

  - CVE-2016-2313: Authentication using web authentication     as a user not in the cacti database allows complete     access (boo#965930)

The following non-security bugs were fixed :

boo#965864: Poller Script Parser was broken (boo#965864)

cacti-spine was updated to match the cacti version, fixing a number of upstream bugs.

cacti was updated to fix the following vulnerabilities :

  - CVE-2015-8369: SQL injection in graph.php (boo#958863)

  - CVE-2015-8604: SQL injection in graphs_new.php     (boo#960678)

  - CVE-2015-8377: SQL injection vulnerability in the     host_new_graphs_save function in graphs_new.php     (boo#958977)

  - CVE-2016-2313: Authentication using web authentication     as a user not in the cacti database allows complete     access (boo#965930)

The following non-security bugs were fixed :

  - boo#965864: Poller Script Parser was broken

cacti-spine was updated to match the cacti version, fixing a number of upstream bugs.

cacti was updated to fix the following vulnerabilities :

  - CVE-2015-8369: SQL injection in graph.php (boo#958863)

  - CVE-2015-8604: SQL injection in graphs_new.php     (boo#960678)

  - CVE-2015-8377: SQL injection vulnerability in the     host_new_graphs_save function in graphs_new.php     (boo#958977)

  - CVE-2016-2313: Authentication using web authentication     as a user not in the cacti database allows complete     access (boo#965930)

cacti-spine was updated to match the cacti version, fixing a number of upstream bugs.

NVD reports :

SQL injection vulnerability in include/top_graph_header.php in Cacti 0.8.8f and earlier allows remote attackers to execute arbitrary SQL commands via the rra_id parameter in a properties action to graph.php.

It was discovered that there was a regression in the patch intended to fix CVE-2015-8369 in the recent upload of cacti 0.8.7g-1+squeeze9+deb6u12.

For Debian 6 Squeeze, this issue has been fixed in cacti version 0.8.7g-1+squeeze9+deb6u13.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Several SQL injection vulnerabilities have been discovered in Cacti, an RRDTool frontend written in PHP. Specially crafted input can be used by an attacker in the rra_id value of the graph.php script to execute arbitrary SQL commands on the database.

ID	Name	Product	Family	Severity
401006	Alpine: multiple cacti packages: security update to 0.8.8-r0 (deprecated)	Tenable Cloud Security	Alpine Linux Local Security Checks	critical
401006	Alpine: multiple cacti packages: security update to 0.8.8-r0 (deprecated)	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	critical
400984	Alpine: multiple cacti packages: security update to 0.8.8-r2 (deprecated)	Tenable Cloud Security	Alpine Linux Local Security Checks	critical
400984	Alpine: multiple cacti packages: security update to 0.8.8-r2 (deprecated)	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	critical
92349	GLSA-201607-05 : Cacti: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
88734	openSUSE Security Update : cacti (openSUSE-2016-201)	Nessus	SuSE Local Security Checks	high
88733	openSUSE Security Update : cacti (openSUSE-2016-199)	Nessus	SuSE Local Security Checks	high
88732	openSUSE Security Update : cacti (openSUSE-2016-198)	Nessus	SuSE Local Security Checks	high
87749	FreeBSD : cacti -- SQL injection vulnerabilities (bb961ff3-b3a4-11e5-8255-5453ed2e2b49)	Nessus	FreeBSD Local Security Checks	high
87606	Debian DLA-374-3 : cacti regression update	Nessus	Debian Local Security Checks	high
87430	Debian DSA-3423-1 : cacti - security update	Nessus	Debian Local Security Checks	high

Detections

Analytics

CVE-2015-8369

critical

Tenable Plugins

critical

critical

critical

critical

high

high

high

high

high

high

high