SQL injection vulnerability in templates_export.php in Cacti 0.8.7e and earlier allows remote attackers to execute arbitrary SQL commands via the export_item_id parameter.

According to its self-reported version number, the Cacti application running on the remote web server is prior to version 0.8.7f. It is, therefore, potentially affected by the following vulnerabilities :

  - A vulnerability exists in 'templates_export.php' due to     improper validation of input to the 'export_item_id'     parameter. A remote attacker can exploit this to inject     SQL queries to disclose arbitrary data. (CVE-2010-1431)

  - Cross-site scripting vulnerabilities exist related to     the 'host_id' parameter of 'data_sources.php', or the     'hostname' and 'description' parameters of 'host.php',     which a remote attacker can exploit to inject arbitrary     web script or HTML. (CVE-2010-1644)

  - A SQL injection vulnerability in 'graph.php' exists     which can be exploited by a remote attacker using     specially crafted GET requests to the 'rra_id' parameter     which can cause a corresponding POST request or cookie     to bypass proper validation. (CVE-2010-2092)

Missing input sanitation in the template export feature allowed for SQL injection attacks (CVE-2010-1431).

Bonsai information security reports :

A Vulnerability has been discovered in Cacti, which can be exploited by any user to conduct SQL Injection attacks. Input passed via the 'export_item_id' parameter to 'templates_export.php' script is not properly sanitized before being used in a SQL query.

The same source also reported a command execution vulnerability. This second issue can be exploited by Cacti users who have the rights to modify device or graph configurations.

ID	Name	Product	Family	Severity
46222	Cacti < 0.8.7f Multiple Input Validation Vulnerabilities	Nessus	CGI abuses	high
46185	openSUSE Security Update : cacti (openSUSE-SU-2010:0181-1)	Nessus	SuSE Local Security Checks	high
45614	FreeBSD : cacti -- SQL injection and command execution vulnerabilities (5198ef84-4fdc-11df-83fb-0015587e2cc1)	Nessus	FreeBSD Local Security Checks	high

Detections

Analytics

CVE-2010-1431

critical

Tenable Plugins

high

high

high