Published: 22/12/2023 Updated: 18/03/2024

CVSS v3 Base Score: 8.8 | Impact Score: 5.9 | Exploitability Score: 2.8

VMScore: 0

Cacti provides an operational monitoring and fault management framework. In versions 1.2.25 and prior, it is possible to execute arbitrary SQL code through the `pollers.php` script. An authorized user may be able to execute arbitrary SQL code. The vulnerable component is the `pollers.php`. Impact of the vulnerability - arbitrary SQL code execution. As of time of publication, a patch does not appear to exist.

Vulnerable Product	Search on Vulmon	Subscribe to Product
cacti cacti

This Metasploit exploit module leverages sql injection and local file inclusion vulnerabilities in Cacti versions prior to 1226 to achieve remote code execution Authentication is needed and the account must have access to the vulnerable PHP script (pollersphp) This is granted by setting the Sites/Devices/Data permission in the General Administ ...

This exploit module leverages a SQLi (CVE-2023-49085) and a LFI (CVE-2023-49084) vulnerability in Cacti versions prior to 1226 to achieve RCE Authentication is needed and the account must have access to the vulnerable PHP script (`pollersphp`) This is granted by setting the `Sites/Devices/Data` permissio ...

This exploit module leverages a SQLi (CVE-2023-49085) and a LFI (CVE-2023-49084) vulnerability in Cacti versions prior to 1.2.26 to achieve RCE. Authentication is needed and the account must have access to the vulnerable PHP script (`pollers.php`). This is granted by setting the `Sites/Devices/Data` permission in the `General Administration` section.

msf > use exploit/multi/http/cacti_pollers_sqli_rce
msf exploit(cacti_pollers_sqli_rce) > show targets
    ...targets...
msf exploit(cacti_pollers_sqli_rce) > set TARGET < target-id >
msf exploit(cacti_pollers_sqli_rce) > show options
    ...show and set options...
msf exploit(cacti_pollers_sqli_rce) > exploit

CWE-89 https://github.com/Cacti/cacti/security/advisories/GHSA-vr3c-38wh-g855 https://github.com/Cacti/cacti/blob/5f6f65c215d663a775950b2d9db35edbaf07d680/pollers.php#L451 http://packetstormsecurity.com/files/176995/Cacti-pollers.php-SQL-Injection-Remote-Code-Execution.html https://lists.debian.org/debian-lts-announce/2024/03/msg00018.html https://nvd.nist.gov https://packetstormsecurity.com/files/176995/Cacti-pollers.php-SQL-Injection-Remote-Code-Execution.html https://www.rapid7.com/db/modules/exploit/multi/http/cacti_pollers_sqli_rce/

CVE-2023-49085

Vulnerability Summary

Vulnerability Trend

Exploits

Metasploit Modules

References

Vulmon Search

About

Products

Connect