CVE-2005-2149

config.php in Cacti 0.8.6e and earlier allows remote attackers to set the no_http_headers switch, then modify session information to gain privileges and disable the use of addslashes to conduct SQL injection attacks.

Published: Jul 6, 2005
Updated: Apr 13, 2023
CVE: CVE-2005-2149
Severity: High
Exploit:

CVSS v2:

Severity: High
Score: 10
AV:N/AC:L/Au:N/C:C/I:C/A:C

No CWE or OWASP classifications available.

Affected Software
References

Software	From	Fixed in
the_cacti_group / cacti	0.8.5	0.8.5.x
the_cacti_group / cacti	0.8.6b	0.8.6b.x
the_cacti_group / cacti	0.8.6c	0.8.6c.x
the_cacti_group / cacti	0.8.6a	0.8.6a.x
the_cacti_group / cacti	0.8.2a	0.8.2a.x
the_cacti_group / cacti	0.8.3a	0.8.3a.x
the_cacti_group / cacti	0.8	0.8.x
the_cacti_group / cacti	0.8.5a	0.8.5a.x
the_cacti_group / cacti	0.8.4	0.8.4.x
the_cacti_group / cacti	0.8.6	0.8.6.x
the_cacti_group / cacti	0.8.3	0.8.3.x
the_cacti_group / cacti	0.8.1	0.8.1.x
the_cacti_group / cacti	0.8.2	0.8.2.x
the_cacti_group / cacti	0.8.6d	0.8.6d.x
the_cacti_group / cacti	0.8.6e	0.8.6e.x

Vulnerability Database

289,697

CVE-2005-2149