BID:14027

RaXnet Cacti Multiple SQL Injection Vulnerabilities

Info

RaXnet Cacti Multiple SQL Injection Vulnerabilities

Bugtraq ID:	14027
Class:	Input Validation Error
CVE:	CVE-2005-1525 CVE-2005-2148
Remote:	Yes
Local:	No
Published:	Jun 22 2005 12:00AM
Updated:	Jul 12 2009 04:06PM
Credit:	Discovery is credited to an anonymous researcher.
Vulnerable:	Raxnet Cacti 0.8.6 d Raxnet Cacti 0.8.6 c Raxnet Cacti 0.8.6 b Raxnet Cacti 0.8.6 a Raxnet Cacti 0.8.6 Raxnet Cacti 0.8.5 a Raxnet Cacti 0.8.5 Raxnet Cacti 0.8.4 Raxnet Cacti 0.8.3 a Raxnet Cacti 0.8.3 Raxnet Cacti 0.8.2 a Raxnet Cacti 0.8.2 Raxnet Cacti 0.8.1 Raxnet Cacti 0.8 Raxnet Cacti 0.6.8 a Raxnet Cacti 0.6.8 Raxnet Cacti 0.6.7 + Debian Linux 3.0 Raxnet Cacti 0.6.6 Raxnet Cacti 0.6.5 Raxnet Cacti 0.6.4 Raxnet Cacti 0.6.3 Raxnet Cacti 0.6.2 Raxnet Cacti 0.6.1 Raxnet Cacti 0.6 Raxnet Cacti 0.5 Gentoo Linux Debian Linux 3.1 sparc Debian Linux 3.1 s/390 Debian Linux 3.1 ppc Debian Linux 3.1 mipsel Debian Linux 3.1 mips Debian Linux 3.1 m68k Debian Linux 3.1 ia-64 Debian Linux 3.1 ia-32 Debian Linux 3.1 hppa Debian Linux 3.1 arm Debian Linux 3.1 alpha Debian Linux 3.1 Debian Linux 3.0 sparc Debian Linux 3.0 s/390 Debian Linux 3.0 ppc Debian Linux 3.0 mipsel Debian Linux 3.0 mips Debian Linux 3.0 m68k Debian Linux 3.0 ia-64 Debian Linux 3.0 ia-32 Debian Linux 3.0 hppa Debian Linux 3.0 arm Debian Linux 3.0 alpha Debian Linux 3.0

Not Vulnerable:	Raxnet Cacti 0.8.6 e

Discussion

RaXnet Cacti Multiple SQL Injection Vulnerabilities

Cacti is prone to multiple SQL injection vulnerabilities.

These issues could permit remote attackers to pass malicious input to database queries, resulting in modification of query logic or other attacks.

Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation. An attacker can obtain the administrative password by exploiting these issues.

Cacti versions prior to 0.8.6e are affected by these vulnerabilities.

Exploit / POC

RaXnet Cacti Multiple SQL Injection Vulnerabilities

No exploit is required.

Solution / Fix

RaXnet Cacti Multiple SQL Injection Vulnerabilities

Solution:
The vendor has released Cacti 0.8.6e to address these issues.

Gentoo Linux has released advisory GLSA 200506-20 to address this, and other issues. Users of affected packages are urged to execute the following commands with superuser privileges:

emerge --sync
emerge --ask --oneshot --verbose ">=net-analyzer/cacti-0.8.6e"

Please see the referenced advisory for further information.

Conectiva Linux advisory CLSA-2005:978 is available to address various issues affecting cacti. Please see the referenced advisory for more information.

Gentoo Linux has updated advisory GLSA 200506-20 to GLSA 200506-20:02 to address this, and other issues. Users of affected packages are urged to execute the following commands with superuser privileges:

emerge --sync
emerge --ask --oneshot --verbose ">=net-analyzer/cacti-0.8.6f"

Please see the referenced advisory for further information.

Debian GNU/Linux has released advisory DSA 764-1 to address various issues in Cacti. Please see the referenced advisory for further information.

Raxnet Cacti 0.5