CVE-2008-0785: SQL Injection
Description of problem:
Lack of input saintization can reportedly [1] [2] compose XSS, SQL injection or HTTP response splitting attack vector.
[1] http://www.cacti.net/releasenotes087b.php [2] http://secunia.com/advisories/28872/
Other sources
Multiple SQL injection vulnerabilities in Cacti 0.8.7 before 0.8.7b and 0.8.6 before 0.8.6k allow remote authenticated users to execute arbitrary SQL commands via the (1) graphlist parameter to graphview.php, (2) leafid and id parameters to tree.php, (3) localgraphid parameter to graphxport.php, and (4) loginusername parameter to index.php/login.
— MITRE
Affected Software
Remediation
Patch Available
Patch Available
Event History
Frequently Asked Questions
What vulnerabilities are associated with CVE-2008-0785?
CVE-2008-0785 is associated with input sanitization vulnerabilities which can lead to XSS, SQL injection, or HTTP response splitting attacks.
What versions of Cacti are affected by CVE-2008-0785?
CVE-2008-0785 affects multiple versions of Cacti including 0.6.7 and versions starting from 0.8 up to 0.8.7a.
What is the impact of CVE-2008-0785?
The impact of CVE-2008-0785 can result in unauthorized access to systems, data leakage, or data manipulation.
How do I fix CVE-2008-0785?
To fix CVE-2008-0785, upgrade to a secure version of Cacti that correctly implements input sanitization.
Is there a patch available for CVE-2008-0785?
Yes, a patch is typically included in the newer releases of Cacti following the vulnerabilities addressed in CVE-2008-0785.