SQL Injection vulnerability when managing SNMP Notification Receivers
Summary
SQL Injection vulnerability when managing SNMP Notification Receivers
Original description
The description as published by the source.
Cacti provides an operational monitoring and fault management framework. Version 1.2.25 has a Blind SQL Injection (SQLi) vulnerability within the SNMP Notification Receivers feature in the file ‘managers.php’. An authenticated attacker with the “Settings/Utilities” permission can send a crafted HTTP GET request to the endpoint ‘/cacti/managers.php’ with an SQLi payload in the ‘selected_graphs_array’ HTTP GET parameter. As of time of publication, no patched versions exist.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
Fix status by distribution
Fixed packages published by each distribution for this CVE
- Debian DEBIAN-CVE-2023-51448 cacti Fixed in: 1.2.26+ds1-1
References
- advisory github.com
- advisory github.com
- advisory nvd.nist.gov
- web github.com
- web lists.fedoraproject.org