CVE-2004-1737: SQL Injection
First published: Mon Aug 16 2004(Updated: )
SQL injection vulnerability in auth_login.php in Cacti 0.8.5a allows remote attackers to execute arbitrary SQL commands and bypass authentication via the (1) username or (2) password parameters.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Cacti | =0.6 | |
| Cacti | =0.6.1 | |
| Cacti | =0.6.2 | |
| Cacti | =0.6.3 | |
| Cacti | =0.6.4 | |
| Cacti | =0.6.5 | |
| Cacti | =0.6.6 | |
| Cacti | =0.6.7 | |
| Cacti | =0.6.8 | |
| Cacti | =0.6.8a | |
| Cacti | =0.8 | |
| Cacti | =0.8.1 | |
| Cacti | =0.8.2 | |
| Cacti | =0.8.2a | |
| Cacti | =0.8.3 | |
| Cacti | =0.8.3a | |
| Cacti | =0.8.4 | |
| Cacti | =0.8.5 | |
| Cacti | =0.8.5a | |
| Gentoo Linux | =1.4 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://lists.grok.org.uk/pipermail/full-disclosure/2004-August/025376.html
- http://www.gentoo.org/security/en/glsa/glsa-200408-21.xml
- http://www.securityfocus.com/bid/10960
- http://secunia.com/advisories/12308
- http://marc.info/?l=bugtraq&m=109272483621038&w=2
- https://exchange.xforce.ibmcloud.com/vulnerabilities/17011
Frequently Asked Questions
What is the severity of CVE-2004-1737?
CVE-2004-1737 has a medium severity level due to its potential for unauthorized SQL command execution.
How do I fix CVE-2004-1737?
To fix CVE-2004-1737, update Cacti to a version that is not vulnerable, specifically versions 0.8.5 or later.
Which Cacti versions are affected by CVE-2004-1737?
CVE-2004-1737 affects Cacti versions from 0.6 to 0.8.5a.
Can CVE-2004-1737 be exploited remotely?
Yes, CVE-2004-1737 can be exploited remotely by attackers using the username or password parameters.
What types of attacks can occur due to CVE-2004-1737?
CVE-2004-1737 can allow attackers to execute arbitrary SQL commands, potentially leading to authentication bypass.
- agent/references
- agent/type
- agent/softwarecombine
- agent/first-publish-date
- collector/mitre-cve
- source/MITRE
- agent/author
- agent/remedy
- agent/last-modified-date
- agent/weakness
- agent/severity
- agent/description
- agent/event
- agent/source
- agent/tags
- collector/nvd-index
- agent/software-canonical-lookup-request
- collector/nvd-historical
- vendor/the cacti group
- canonical/cacti
- version/cacti/0.6
- version/cacti/0.6.1
- version/cacti/0.6.2
- version/cacti/0.6.3
- version/cacti/0.6.4
- version/cacti/0.6.5
- version/cacti/0.6.6
- version/cacti/0.6.7
- version/cacti/0.6.8
- version/cacti/0.6.8a
- version/cacti/0.8
- version/cacti/0.8.1
- version/cacti/0.8.2
- version/cacti/0.8.2a
- version/cacti/0.8.3
- version/cacti/0.8.3a
- version/cacti/0.8.4
- version/cacti/0.8.5
- version/cacti/0.8.5a
- vendor/gentoo
- canonical/gentoo linux
- version/gentoo linux/1.4