Blind SQL Injection Vulnerability in Cacti Package
Summary
DEBIAN-CVE-2023-51448: Cacti provides an operational monitoring and fault management framework. Affects cacti versions < 1.2.26+ds1-1. Fixed in 1.2.26+ds1-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Cacti is an open-source network monitoring and graphing tool designed to harness the power of RRDTool's data logging and graphing functionality. It provides an operational monitoring and fault management framework, allowing users to visualize network data through customizable graphs. The vulnerability in question affects versions prior to 1.2.26+ds1-1, specifically within the SNMP Notification Receivers feature, which can be exploited by authenticated users with specific permissions.
Vulnerability Detail
The vulnerability identified as DEBIAN-CVE-2023-51448 is a Blind SQL Injection (SQLi) flaw found in Cacti version 1.2.25. This issue arises in the 'managers.php' file, where an authenticated attacker with 'Settings/Utilities' permission can exploit the vulnerability by sending a crafted HTTP GET request to the '/cacti/managers.php' endpoint. The attacker can inject SQL payloads through the 'selected_graphs_array' parameter, potentially leading to unauthorized data access or manipulation. As of the publication date, no patched versions exist for this vulnerability.
How To Fix
Minimum fixed version
1.2.26+ds1-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade cactiTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, users can limit access to the 'managers.php' file by adjusting permissions or implementing network-level restrictions to prevent unauthorized access until a patch is applied.
Conclusion
The Blind SQL Injection vulnerability in the Cacti package poses a significant risk to users with specific permissions. It is essential to update to the patched version once available and implement temporary workarounds to mitigate the risk until a fix is released.
See every vulnerability recorded for cacti →
FAQ
A Blind SQL Injection vulnerability allows an attacker to send SQL queries to a database without directly seeing the results. The attacker can infer information based on the application's behavior.
Only authenticated users with 'Settings/Utilities' permissions can exploit this vulnerability, making it crucial to manage user permissions carefully.
Exploitation of this vulnerability can lead to unauthorized access to sensitive data, data manipulation, or even complete system compromise.
As of the publication date, no patched versions exist for this vulnerability. Users are advised to monitor for updates from the maintainers.
You can use Vulert, which monitors open-source vulnerabilities in your software. By using the Vulert playground, you can check if your application is affected without needing to sign up.
References
Related vulnerabilities
Recent vulnerabilities recorded for cacti.
