CVE-2005-2149: SQL Injection
config.php in Cacti 0.8.6e and earlier allows remote attackers to set the nohttpheaders switch, then modify session information to gain privileges and disable the use of addslashes to conduct SQL injection attacks.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2005-2149?
CVE-2005-2149 is considered a medium severity vulnerability due to its potential for allowing privilege escalation and SQL injection.
How do I fix CVE-2005-2149?
To fix CVE-2005-2149, upgrade to Cacti version 0.8.6f or later, which contains security patches.
Which versions of Cacti are affected by CVE-2005-2149?
CVE-2005-2149 affects Cacti versions 0.8.6e and earlier, including versions 0.8.5 and 0.8.6d.
What actions can an attacker take due to CVE-2005-2149?
An attacker exploiting CVE-2005-2149 could modify session information and disable SQL input sanitization, leading to SQL injection attacks.
How can I identify if my Cacti installation is vulnerable to CVE-2005-2149?
You can identify if your Cacti installation is vulnerable by checking your installed version against the affected versions listed in CVE-2005-2149.