config.php in Cacti 0.8.6e and earlier allows remote attackers to set the no_http_headers switch, then modify session information to gain privileges and disable the use of addslashes to conduct SQL injection attacks.

According to its self-reported version number, the Cacti application running on the remote web server is prior to version 0.8.6f. It is, therefore, potentially affected by the following vulnerabilities :

  - Multiple vulnerabilities exist due to improper input     validation in 'graph_image.php' and 'graph.php'.
    (CVE-2005-2148)

  - A flaw exists in 'config.php' that allows remote     attackers to set the 'no_http_headers' switch and then     modify session information in order to gain the     privileges necessary to perform SQL injection attacks.
    (CVE-2005-2149)

Several vulnerabilities have been discovered in cacti, a round-robin database (RRD) tool that helps create graphs from database information. The Common Vulnerabilities and Exposures Project identifies the following problems :

  - CAN-2005-1524     Maciej Piotr Falkiewicz and an anonymous researcher     discovered an input validation bug that allows an     attacker to include arbitrary PHP code from remote sites     which will allow the execution of arbitrary code on the     server running cacti.

  - CAN-2005-1525

    Due to missing input validation cacti allows a remote     attacker to insert arbitrary SQL statements.

  - CAN-2005-1526

    Maciej Piotr Falkiewicz discovered an input validation     bug that allows an attacker to include arbitrary PHP     code from remote sites which will allow the execution of     arbitrary code on the server running cacti.

  - CAN-2005-2148

    Stefan Esser discovered that the update for the above     mentioned vulnerabilities does not perform proper input     validation to protect against common attacks.

  - CAN-2005-2149

    Stefan Esser discovered that the update for     CAN-2005-1525 allows remote attackers to modify session     information to gain privileges and disable the use of     addslashes to protect against SQL injection.

The Cacti application running on the remote web server is affected by an authentication bypass vulnerability.

ID	Name	Product	Family	Severity
81602	Cacti < 0.8.6f Multiple Vulnerabilities	Nessus	CGI abuses	high
19258	Debian DSA-764-1 : cacti - several vulnerabilities	Nessus	Debian Local Security Checks	critical
18619	Cacti < 0.8.6f Authentication Bypass Vulnerability	Nessus	CGI abuses	high

Detections

Analytics

CVE-2005-2149

critical

Tenable Plugins

high

critical

high