Total vulnerabilities in the database
Cacti provides an operational monitoring and fault management framework. Version 1.2.25 has a Blind SQL Injection (SQLi) vulnerability within the SNMP Notification Receivers feature in the file ‘managers.php’. An authenticated attacker with the “Settings/Utilities” permission can send a crafted HTTP GET request to the endpoint ‘/cacti/managers.php’ with an SQLi payload in the ‘selected_graphs_array’ HTTP GET parameter. As of time of publication, no patched versions exist.
| Software | From | Fixed in |
|---|---|---|
| cacti / cacti | 1.2.25 | 1.2.25.x |