// For flags

CVE-2023-51448

SQL Injection vulnerability when managing SNMP Notification Receivers

Severity Score

8.8
*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

2
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

-
*SSVC
Descriptions

Cacti provides an operational monitoring and fault management framework. Version 1.2.25 has a Blind SQL Injection (SQLi) vulnerability within the SNMP Notification Receivers feature in the file `‘managers.php’`. An authenticated attacker with the “Settings/Utilities” permission can send a crafted HTTP GET request to the endpoint `‘/cacti/managers.php’` with an SQLi payload in the `‘selected_graphs_array’` HTTP GET parameter. As of time of publication, no patched versions exist.

Cacti proporciona un framework de monitoreo operativo y gestión de fallos. La versión 1.2.25 tiene una vulnerabilidad de inyección Blind SQL (SQLi) dentro de la función de receptores de notificaciones SNMP en el archivo ``managers.php''. Un atacante autenticado con el permiso "Configuración/Utilidades" puede enviar una solicitud HTTP GET manipulada al endpoint `'/cacti/managers.php'` con un payload SQLi en el parámetro HTTP GET `'selected_graphs_array'`. Al momento de la publicación, no existen versiones parcheadas.

*Credits: N/A
CVSS Scores
Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High
* Common Vulnerability Scoring System
SSVC
  • Decision:-
Exploitation
-
Automatable
-
Tech. Impact
-
* Organization's Worst-case Scenario
Timeline
  • 2023-12-19 CVE Reserved
  • 2023-12-22 CVE Published
  • 2024-08-02 CVE Updated
  • 2024-08-02 First Exploit
  • 2024-10-28 EPSS Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
CWE
  • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
CAPEC
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Cacti
Search vendor "Cacti"
Cacti
Search vendor "Cacti" for product "Cacti"
1.2.25
Search vendor "Cacti" for product "Cacti" and version "1.2.25"
-
Affected