SQL injection vulnerability in the host_new_graphs_save function in graphs_new.php in Cacti 0.8.8f and earlier allows remote authenticated users to execute arbitrary SQL commands via crafted serialized data in the selected_graphs_array parameter in a save action.

The remote host is affected by the vulnerability described in GLSA-201607-05 (Cacti: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Cacti. Please review       the CVE identifiers referenced below for details.
  Impact :

    A remote attacker could possibly execute arbitrary code with the       privileges of the process, or remote authenticated users could bypass       intended access restrictions.
  Workaround :

    There is no known workaround at this time.

Various cross-site scripting (XSS) flaws (CVE-2013-5588 , CVE-2014-5025 , CVE-2014-5026) and various SQL injection flaws (CVE-2013-5589 , CVE-2015-4342 , CVE-2015-4634 , CVE-2015-8377 , CVE-2015-8604) were discovered affecting versions of Cacti prior to 0.8.8g.

Cross-site scripting (XSS) vulnerability in Cacti before 0.8.8d allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. (CVE-2015-2665)

SQL injection vulnerability in the get_hash_graph_template function in lib/functions.php in Cacti before 0.8.8d allows remote attackers to execute arbitrary SQL commands via the graph_template_id parameter to graph_templates.php. (CVE-2015-4454)

The Cacti Group, Inc. reports :

Changelog

- bug:0002652: CVE-2015-8604: SQL injection in graphs_new.php

- bug:0002655: CVE-2015-8377: SQL injection vulnerability in the host_new_graphs_save function in graphs_new.php

- bug:0002656: Authentication using web authentication as a user not in the cacti database allows complete access

Two SQL injection vulnerabilities were discovered in cacti, a web interface for graphing of monitoring systems. Specially crafted input can be used by an attacker in parameters of the graphs_new.php script to execute arbitrary SQL commands on the database.

cacti was updated to fix the following vulnerabilities :

  - CVE-2015-8369: SQL injection in graph.php (boo#958863)

  - CVE-2015-8604: SQL injection in graphs_new.php     (boo#960678)

  - CVE-2015-8377: SQL injection vulnerability in the     host_new_graphs_save function in graphs_new.php     (boo#958977)

  - CVE-2016-2313: Authentication using web authentication     as a user not in the cacti database allows complete     access (boo#965930)

The following non-security bugs were fixed :

boo#965864: Poller Script Parser was broken (boo#965864)

cacti-spine was updated to match the cacti version, fixing a number of upstream bugs.

cacti was updated to fix the following vulnerabilities :

  - CVE-2015-8369: SQL injection in graph.php (boo#958863)

  - CVE-2015-8604: SQL injection in graphs_new.php     (boo#960678)

  - CVE-2015-8377: SQL injection vulnerability in the     host_new_graphs_save function in graphs_new.php     (boo#958977)

  - CVE-2016-2313: Authentication using web authentication     as a user not in the cacti database allows complete     access (boo#965930)

The following non-security bugs were fixed :

  - boo#965864: Poller Script Parser was broken

cacti-spine was updated to match the cacti version, fixing a number of upstream bugs.

cacti was updated to fix the following vulnerabilities :

  - CVE-2015-8369: SQL injection in graph.php (boo#958863)

  - CVE-2015-8604: SQL injection in graphs_new.php     (boo#960678)

  - CVE-2015-8377: SQL injection vulnerability in the     host_new_graphs_save function in graphs_new.php     (boo#958977)

  - CVE-2016-2313: Authentication using web authentication     as a user not in the cacti database allows complete     access (boo#965930)

cacti-spine was updated to match the cacti version, fixing a number of upstream bugs.

ID	Name	Product	Family	Severity
92349	GLSA-201607-05 : Cacti: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
90155	Amazon Linux AMI : cacti (ALAS-2016-673)	Nessus	Amazon Linux Local Security Checks	high
89063	FreeBSD : cacti -- multiple vulnerabilities (db3301be-e01c-11e5-b2bd-002590263bf5)	Nessus	FreeBSD Local Security Checks	high
89001	Debian DSA-3494-1 : cacti - security update	Nessus	Debian Local Security Checks	high
88734	openSUSE Security Update : cacti (openSUSE-2016-201)	Nessus	SuSE Local Security Checks	high
88733	openSUSE Security Update : cacti (openSUSE-2016-199)	Nessus	SuSE Local Security Checks	high
88732	openSUSE Security Update : cacti (openSUSE-2016-198)	Nessus	SuSE Local Security Checks	high

Detections

Analytics

CVE-2015-8377

high

Tenable Plugins

high

high

high

high

high

high

high