SQL Injection vulnerability in Cacti v1.2.25 allows a remote attacker to obtain sensitive information via the form_actions() function in the managers.php function.

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

  - Cacti is an open source operational monitoring and fault management framework. Affected versions are
    subject to a SQL injection discovered in graph_view.php. Since guest users can access graph_view.php
    without authentication by default, if guest users are being utilized in an enabled state, there could be
    the potential for significant damage. Attackers may exploit this vulnerability, and there may be
    possibilities for actions such as the usurpation of administrative privileges or remote code execution.
    This issue has been addressed in version 1.2.25. Users are advised to upgrade. There are no known
    workarounds for this vulnerability. (CVE-2023-39361)

  - Cacti is an open source operational monitoring and fault management framework. There are two instances of
    insecure deserialization in Cacti version 1.2.24. While a viable gadget chain exists in Cacti’s vendor
    directory (phpseclib), the necessary gadgets are not included, making them inaccessible and the insecure
    deserializations not exploitable. Each instance of insecure deserialization is due to using the
    unserialize function without sanitizing the user input. Cacti has a “safe” deserialization that attempts
    to sanitize the content and check for specific values before calling unserialize, but it isn’t used in
    these instances. The vulnerable code lies in graphs_new.php, specifically within the host_new_graphs_save
    function. This issue has been addressed in version 1.2.25. Users are advised to upgrade. There are no
    known workarounds for this vulnerability. (CVE-2023-30534)

  - Cacti is an open source operational monitoring and fault management framework. A defect in the sql_save
    function was discovered. When the column type is numeric, the sql_save function directly utilizes user
    input. Many files and functions calling the sql_save function do not perform prior validation of user
    input, leading to the existence of multiple SQL injection vulnerabilities in Cacti. This allows
    authenticated users to exploit these SQL injection vulnerabilities to perform privilege escalation and
    remote code execution. This issue has been addressed in version 1.2.25. Users are advised to upgrade.
    There are no known workarounds for this vulnerability. (CVE-2023-39357)

  - Cacti is an open source operational monitoring and fault management framework. An authenticated SQL
    injection vulnerability was discovered which allows authenticated users to perform privilege escalation
    and remote code execution. The vulnerability resides in the `reports_user.php` file. In
    `ajax_get_branches`, the `tree_id` parameter is passed to the `reports_get_branch_select` function without
    any validation. This issue has been addressed in version 1.2.25. Users are advised to upgrade. There are
    no known workarounds for this vulnerability. (CVE-2023-39358)

  - Cacti is an open source operational monitoring and fault management framework. An authenticated SQL
    injection vulnerability was discovered which allows authenticated users to perform privilege escalation
    and remote code execution. The vulnerability resides in the `graphs.php` file. When dealing with the cases
    of ajax_hosts and ajax_hosts_noany, if the `site_id` parameter is greater than 0, it is directly reflected
    in the WHERE clause of the SQL statement. This creates an SQL injection vulnerability. This issue has been
    addressed in version 1.2.25. Users are advised to upgrade. There are no known workarounds for this
    vulnerability. (CVE-2023-39359)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - SQL Injection vulnerability in Cacti v1.2.25 allows a remote attacker to obtain sensitive information via     the form_actions() function in the managers.php function. (CVE-2023-46490)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Severity
427137	Alpine: multiple cacti packages: security update to 1.2.26-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	critical
427137	Alpine: multiple cacti packages: security update to 1.2.26-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	critical
226925	Linux Distros Unpatched Vulnerability : CVE-2023-46490	Nessus	Misc.	medium
408249	Alpine: multiple cacti packages: security update to 1.2.26-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	critical
408249	Alpine: multiple cacti packages: security update to 1.2.26-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	critical

Detections

Analytics

CVE-2023-46490

medium

Tenable Plugins

critical

critical

medium

critical

critical