Cacti SQL Injection vulnerability in lib/html_form_templates.php by reading dirty data stored in database
Résumé
Cacti SQL Injection vulnerability in lib/html_form_templates.php by reading dirty data stored in database
Description d'origine
La description telle que publiée par la source (souvent en anglais).
Cacti provides an operational monitoring and fault management framework. Prior to version 1.2.27, some of the data stored in form_save() function in graph_template_inputs.php is not thoroughly checked and is used to concatenate the SQL statement in draw_nontemplated_fields_graph_item() function from lib/html_form_templates.php , finally resulting in SQL injection. Version 1.2.27 contains a patch for the issue.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
État des correctifs par distribution
Paquets corrigés publiés par chaque distribution pour cette CVE
- Debian DEBIAN-CVE-2024-31458 cacti Corrigé dans: 1.2.16+ds1-2+deb11u4
Références
- advisory github.com
- advisory github.com
- advisory nvd.nist.gov
- web lists.debian.org
- web lists.fedoraproject.org