CVE-2023-51448

Katalog CVE

CVSS 8.8 · High EPSS 67,3%

Kerentanan Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') pada cacti. Skor CVSS 3.1 8.8 (High) menurut NVD.

Deskripsi (NVD)

Cacti provides an operational monitoring and fault management framework. Version 1.2.25 has a Blind SQL Injection (SQLi) vulnerability within the SNMP Notification Receivers feature in the file `‘managers.php’`. An authenticated attacker with the “Settings/Utilities” permission can send a crafted HTTP GET request to the endpoint `‘/cacti/managers.php’` with an SQLi payload in the `‘selected_graphs_array’` HTTP GET parameter. As of time of publication, no patched versions exist.

Rincian

Terbit di NVD

22 Desember 2023

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

8.8 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

EPSS (30 hari)

67,3% peluang dieksploitasi; lebih tinggi dari 99,2% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/Cacti/cacti/blob/5f6f65c215d663a775950b2d9db35edbaf07d680/managers.php#L941 exploit · advisory vendor
• https://github.com/Cacti/cacti/security/advisories/GHSA-w85f-7c4w-7594 exploit · advisory vendor
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RBEOAFKRARQHTDI...