SQL injection vulnerability in Cacti 0.8.6i and earlier, when register_argc_argv is enabled, allows remote attackers to execute arbitrary SQL commands via the (1) second or (2) third arguments to cmd.php. NOTE: this issue can be leveraged to execute arbitrary commands since the SQL query results are later used in the polling_items array and popen function.

A command injection in cmd.php in cacti was fixed, which might have allowed remote attackers to inject commands and so execute code.
(CVE-2006-6799)

The remote host is affected by the vulnerability described in GLSA-200701-23 (Cacti: Command execution and SQL injection)

    rgod discovered that the Cacti cmd.php and copy_cacti_user.php scripts     do not properly control access to the command shell, and are remotely     accessible by unauthenticated users. This allows SQL injection via     cmd.php and copy_cacti_user.php URLs. Further, the results from the     injected SQL query are not properly sanitized before being passed to a     command shell. The vulnerabilities require that the     'register_argc_argv' option is enabled, which is the Gentoo default.
    Also, a number of similar problems in other scripts were reported.
  Impact :

    These vulnerabilities can result in the execution of arbitrary shell     commands or information disclosure via crafted SQL queries.
  Workaround :

    There is no known workaround at this time.

It was discovered that cacti, a frontend to rrdtool, performs insufficient validation of data passed to the 'cmd' script, which allows SQL injection and the execution of arbitrary shell commands.

The remote host is running Cacti, a web-based, front end to RRDTool for network graphing.

The version of Cacti on the remote host does not properly check to ensure that the 'cmd.php' script is being run from a commandline and fails to sanitize user-supplied input before using it in database queries.  Provided PHP's 'register_argc_argv' parameter is enabled, which is the default, an attacker can launch SQL injection attacks against the underlying database and even to execute arbitrary code on the remote host subject to the privileges of the web server user id.

ID	Name	Product	Family	Severity
27169	openSUSE 10 Security Update : cacti (cacti-2447)	Nessus	SuSE Local Security Checks	high
24308	GLSA-200701-23 : Cacti: Command execution and SQL injection	Nessus	Gentoo Local Security Checks	high
24247	Debian DSA-1250-1 : cacti - missing input sanitising	Nessus	Debian Local Security Checks	high
23963	Cacti cmd.php Multiple Parameter SQL Injection Arbitrary Command Execution	Nessus	CGI abuses	high

Detections

Analytics

CVE-2006-6799

critical

Tenable Plugins

high

high

high

high