7.5
CVSSv2

CVE-2004-1737

Published: 16/08/2004 Updated: 11/07/2017
CVSS v2 Base Score: 7.5 | Impact Score: 6.4 | Exploitability Score: 10
VMScore: 755
Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P

Vulnerability Summary

SQL injection vulnerability in auth_login.php in Cacti 0.8.5a allows remote malicious users to execute arbitrary SQL commands and bypass authentication via the (1) username or (2) password parameters.

Vulnerable Product Search on Vulmon Subscribe to Product

the cacti group cacti 0.6.5

the cacti group cacti 0.6.6

the cacti group cacti 0.8.2a

the cacti group cacti 0.8.3

the cacti group cacti 0.6.3

the cacti group cacti 0.6.4

the cacti group cacti 0.8.1

the cacti group cacti 0.8.2

the cacti group cacti 0.6.1

the cacti group cacti 0.6.2

the cacti group cacti 0.6.8a

the cacti group cacti 0.8

the cacti group cacti 0.8.5

the cacti group cacti 0.8.5a

the cacti group cacti 0.6

the cacti group cacti 0.6.7

the cacti group cacti 0.6.8

the cacti group cacti 0.8.3a

the cacti group cacti 0.8.4

gentoo linux 1.4

Exploits

source: wwwsecurityfocuscom/bid/10960/info RaXnet Cacti is reportedly affected by a remote SQL injection vulnerability This issue occurs in the auth_loginphp script due to a failure of the application to properly sanitize user-supplied "username" URI parameter input before using it in an SQL query It is demonstrated that an attacker m ...