QID 356459

Cacti is an open source operational monitoring and fault management framework.
In cacti 1.2.24, under certain conditions, an authenticated privileged user, can use a malicious string in the snmp options of a device, performing command injection and obtaining remote code execution on the underlying server.
The `lib/snmp.php` file has a set of functions, with similar behavior, that accept in input some variables and place them into an `exec` call without a proper escape or validation.
This issue has been addressed in version 1.2.25.
Users are advised to upgrade.
There are no known workarounds for this vulnerability. (
( CVE-2023-39362) cacti is an open source operational monitoring and fault management framework.
In cacti 1.2.24, users with console access can be redirected to an arbitrary website after a change password performed via a specifically crafted url.
The `auth_changepassword.php` file accepts `ref` as a url parameter and reflects it in the form used to perform the change password.
It's value is used to perform a redirect via `header` php function.
A user can be tricked in performing the change password operation, e.g., via a phishing message, and then interacting with the malicious website where the redirection has been performed, e.g., downloading malwares, providing credentials, etc.
( CVE-2023-39364)

Successful exploitation of this vulnerability could lead to a securitybreach or could affect integrity, availability, and confidentiality.