SQL injection vulnerability in the host_new_graphs function in graphs_new.php in Cacti 0.8.8f and earlier allows remote authenticated users to execute arbitrary SQL commands via the cg_g parameter in a save action.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - SQL injection vulnerability in the host_new_graphs function in graphs_new.php in Cacti 0.8.8f and earlier
    allows remote authenticated users to execute arbitrary SQL commands via the cg_g parameter in a save
    action. (CVE-2015-8604)

The remote host is affected by the vulnerability described in GLSA-201607-05 (Cacti: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Cacti. Please review       the CVE identifiers referenced below for details.
  Impact :

    A remote attacker could possibly execute arbitrary code with the       privileges of the process, or remote authenticated users could bypass       intended access restrictions.
  Workaround :

    There is no known workaround at this time.

Various cross-site scripting (XSS) flaws (CVE-2013-5588 , CVE-2014-5025 , CVE-2014-5026) and various SQL injection flaws (CVE-2013-5589 , CVE-2015-4342 , CVE-2015-4634 , CVE-2015-8377 , CVE-2015-8604) were discovered affecting versions of Cacti prior to 0.8.8g.

Cross-site scripting (XSS) vulnerability in Cacti before 0.8.8d allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. (CVE-2015-2665)

SQL injection vulnerability in the get_hash_graph_template function in lib/functions.php in Cacti before 0.8.8d allows remote attackers to execute arbitrary SQL commands via the graph_template_id parameter to graph_templates.php. (CVE-2015-4454)

The Cacti Group, Inc. reports :

Changelog

- bug:0002652: CVE-2015-8604: SQL injection in graphs_new.php

- bug:0002655: CVE-2015-8377: SQL injection vulnerability in the host_new_graphs_save function in graphs_new.php

- bug:0002656: Authentication using web authentication as a user not in the cacti database allows complete access

Two SQL injection vulnerabilities were discovered in cacti, a web interface for graphing of monitoring systems. Specially crafted input can be used by an attacker in parameters of the graphs_new.php script to execute arbitrary SQL commands on the database.

cacti was updated to fix the following vulnerabilities :

  - CVE-2015-8369: SQL injection in graph.php (boo#958863)

  - CVE-2015-8604: SQL injection in graphs_new.php     (boo#960678)

  - CVE-2015-8377: SQL injection vulnerability in the     host_new_graphs_save function in graphs_new.php     (boo#958977)

  - CVE-2016-2313: Authentication using web authentication     as a user not in the cacti database allows complete     access (boo#965930)

The following non-security bugs were fixed :

boo#965864: Poller Script Parser was broken (boo#965864)

cacti-spine was updated to match the cacti version, fixing a number of upstream bugs.

cacti was updated to fix the following vulnerabilities :

  - CVE-2015-8369: SQL injection in graph.php (boo#958863)

  - CVE-2015-8604: SQL injection in graphs_new.php     (boo#960678)

  - CVE-2015-8377: SQL injection vulnerability in the     host_new_graphs_save function in graphs_new.php     (boo#958977)

  - CVE-2016-2313: Authentication using web authentication     as a user not in the cacti database allows complete     access (boo#965930)

The following non-security bugs were fixed :

  - boo#965864: Poller Script Parser was broken

cacti-spine was updated to match the cacti version, fixing a number of upstream bugs.

cacti was updated to fix the following vulnerabilities :

  - CVE-2015-8369: SQL injection in graph.php (boo#958863)

  - CVE-2015-8604: SQL injection in graphs_new.php     (boo#960678)

  - CVE-2015-8377: SQL injection vulnerability in the     host_new_graphs_save function in graphs_new.php     (boo#958977)

  - CVE-2016-2313: Authentication using web authentication     as a user not in the cacti database allows complete     access (boo#965930)

cacti-spine was updated to match the cacti version, fixing a number of upstream bugs.

It was discovered that there was another SQL injection vulnerability in cacti, a web interface for graphing monitoring systems.

For Debian 6 Squeeze, this issue has been fixed in cacti version 0.8.7g-1+squeeze9+deb6u14.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
400990	Alpine: multiple cacti packages: security update to 0.8.8-r1 (deprecated)	Tenable Cloud Security	Alpine Linux Local Security Checks	high
400990	Alpine: multiple cacti packages: security update to 0.8.8-r1 (deprecated)	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	high
92349	GLSA-201607-05 : Cacti: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
90155	Amazon Linux AMI : cacti (ALAS-2016-673)	Nessus	Amazon Linux Local Security Checks	high
89063	FreeBSD : cacti -- multiple vulnerabilities (db3301be-e01c-11e5-b2bd-002590263bf5)	Nessus	FreeBSD Local Security Checks	high
89001	Debian DSA-3494-1 : cacti - security update	Nessus	Debian Local Security Checks	high
88734	openSUSE Security Update : cacti (openSUSE-2016-201)	Nessus	SuSE Local Security Checks	high
88733	openSUSE Security Update : cacti (openSUSE-2016-199)	Nessus	SuSE Local Security Checks	high
88732	openSUSE Security Update : cacti (openSUSE-2016-198)	Nessus	SuSE Local Security Checks	high
87932	Debian DLA-386-1 : cacti security update	Nessus	Debian Local Security Checks	high

Detections

Analytics

CVE-2015-8604

high

Tenable Plugins

high

high

high

high

high

high

high

high

high

high