Cacti CVE-2013-1434 Multiple SQL Injection Vulnerabilities

Bugtraq ID:	61657
Class:	Input Validation Error
CVE:	CVE-2013-1434
Remote:	Yes
Local:	No
Published:	Aug 06 2013 12:00AM
Updated:	Jan 22 2014 08:32AM
Credit:	Reported by the vendor
Vulnerable:	Planet Technology WSW-2401 0.8.6 h Planet Technology WSW-2401 0.8.6 g MandrakeSoft Enterprise Server 5 x86_64 MandrakeSoft Enterprise Server 5 Gentoo Linux Debian Linux 6.0 sparc Debian Linux 6.0 s/390 Debian Linux 6.0 powerpc Debian Linux 6.0 mips Debian Linux 6.0 ia-64 Debian Linux 6.0 ia-32 Debian Linux 6.0 arm Debian Linux 6.0 amd64 Cacti Cacti 0.8.7 Cacti Cacti 0.8.6 f Cacti Cacti 0.8.6 c Cacti Cacti 0.8.5 a Cacti Cacti 0.8.5 Cacti Cacti 0.8.4 Cacti Cacti 0.8.3 a Cacti Cacti 0.8.3 Cacti Cacti 0.8.2 a Cacti Cacti 0.8.2 Cacti Cacti 0.8.1 Cacti Cacti 0.8 Cacti Cacti 0.6.7 Cacti Cacti 0.8.7i Cacti Cacti 0.8.7h Cacti Cacti 0.8.7g Cacti Cacti 0.8.7f Cacti Cacti 0.8.7e Cacti Cacti 0.8.7d Cacti Cacti 0.8.7c Cacti Cacti 0.8.7b Cacti Cacti 0.8.7a Cacti Cacti 0.8.6k Cacti Cacti 0.8.6j Cacti Cacti 0.8.6i
Not Vulnerable:

Cacti CVE-2013-1434 Multiple SQL Injection Vulnerabilities

Cacti is prone to multiple SQL-injection vulnerabilities because the application fails to properly sanitize user-supplied input.

Exploiting these issues could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

Versions prior to Cacti 0.8.8b are vulnerable.

Cacti CVE-2013-1434 Multiple SQL Injection Vulnerabilities

Attackers can exploit this issue using a browser.

Cacti CVE-2013-1434 Multiple SQL Injection Vulnerabilities

Solution:
Updates are available. Please see the references or vendor advisory for more information.

Cacti CVE-2013-1434 Multiple SQL Injection Vulnerabilities

References:

• Cacti Homepage (Cacti)