config.php in Cacti 0.8.6e and earlier allows remote attackers to set the no_http_headers switch, then modify session information to gain privileges and disable the use of addslashes to conduct SQL injection attacks.
Software | From | Fixed in |
---|---|---|
the_cacti_group / cacti | 0.8 | 0.8.x |
the_cacti_group / cacti | 0.8.1 | 0.8.1.x |
the_cacti_group / cacti | 0.8.2 | 0.8.2.x |
the_cacti_group / cacti | 0.8.2a | 0.8.2a.x |
the_cacti_group / cacti | 0.8.3 | 0.8.3.x |
the_cacti_group / cacti | 0.8.3a | 0.8.3a.x |
the_cacti_group / cacti | 0.8.4 | 0.8.4.x |
the_cacti_group / cacti | 0.8.5 | 0.8.5.x |
the_cacti_group / cacti | 0.8.5a | 0.8.5a.x |
the_cacti_group / cacti | 0.8.6 | 0.8.6.x |
the_cacti_group / cacti | 0.8.6a | 0.8.6a.x |
the_cacti_group / cacti | 0.8.6b | 0.8.6b.x |
the_cacti_group / cacti | 0.8.6c | 0.8.6c.x |
the_cacti_group / cacti | 0.8.6d | 0.8.6d.x |
the_cacti_group / cacti | 0.8.6e | 0.8.6e.x |