CVE-2010-2092: SQL Injection
SQL injection vulnerability in graph.php in Cacti 0.8.7e and earlier allows remote attackers to execute arbitrary SQL commands via a crafted rraid parameter in a GET request in conjunction with a valid rraid value in a POST request or a cookie, which causes the POST or cookie value to bypass the validation routine, but inserts the $GET value into the resulting query.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2010-2092?
CVE-2010-2092 is identified as a medium severity SQL injection vulnerability in Cacti.
How do I fix CVE-2010-2092?
To fix CVE-2010-2092, update to Cacti version 0.8.7 or later, where this vulnerability has been mitigated.
What systems are affected by CVE-2010-2092?
CVE-2010-2092 affects Cacti versions 0.8.7e and earlier, as well as several 0.5 to 0.8.x versions.
How can CVE-2010-2092 be exploited?
CVE-2010-2092 can be exploited by sending a crafted rra_id parameter in a GET request in conjunction with a valid rra_id value in a POST request or cookie.
What are the potential consequences of CVE-2010-2092 exploitation?
Exploitation of CVE-2010-2092 could allow an attacker to execute arbitrary SQL commands on the database.