Main Vulnerability Database Vulnerabilities #VU84816

PHP file inclusion in Cacti - CVE-2023-49084

Published: December 27, 2023 / Updated: February 2, 2024

Vulnerability identifier: #VU84816

CSH Severity: Medium

CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2023-49084

CWE-ID: CWE-98

Exploitation vector: Remote access

Exploit availability: Public exploit is available

Vulnerability details

The vulnerability allows a remote user to include and execute arbitrary PHP files on the server.

The vulnerability exists due to incorrect input validation when including PHP files in link.php. A remote user can send a specially crafted HTTP request to the affected application, include and execute arbitrary PHP code on the system with privileges of the web server.

Affected software

Cacti
Fedora
cacti
cacti-spine

How to mitigate CVE-2023-49084

Install update from vendor's website.

Cacti - update to 1.2.26
cacti - addressed in versions 1.2.27-1.el7, 1.2.27-1.el8, 1.2.27-1.el9, 1.2.27-1.fc39
cacti-spine - addressed in versions 1.2.27-1.el7, 1.2.27-1.el8, 1.2.27-1.el9, 1.2.27-1.fc39

Links to Public Exploits and PoC-codes

Exploit #9540 - Cacti RCE via SQLi in pollers.php (February 2, 2024)

External References

https://github.com/Cacti/cacti/security/advisories/GHSA-pfh9-gwm6-86vp