CVE-2013-1434: SQL Injection
Published Aug 23, 2013
·Updated
Multiple SQL injection vulnerabilities in (1) apipoller.php and (2) utility.php in Cacti before 0.8.8b allow remote attackers to execute arbitrary SQL commands via unspecified vectors.
Affected Software
23 affected components
Cacti Cacti<=0.8.8a
Cacti Cacti=0.8.5
Cacti Cacti=0.8.5a
Cacti Cacti=0.8.6
Cacti Cacti=0.8.6a
Cacti Cacti=0.8.6b
Cacti Cacti=0.8.6c
Cacti Cacti=0.8.6d
Cacti Cacti=0.8.6e
Cacti Cacti=0.8.6f
Cacti Cacti=0.8.6g
Cacti Cacti=0.8.6h
Cacti Cacti=0.8.6i
Cacti Cacti=0.8.6j
Cacti Cacti=0.8.6k
Cacti Cacti=0.8.7
Cacti Cacti=0.8.7a
Cacti Cacti=0.8.7b
Cacti Cacti=0.8.7d
Cacti Cacti=0.8.7e
Cacti Cacti=0.8.7g
Cacti Cacti=0.8.7i
Cacti Cacti=0.8.8
Remediation
Patch Available
Patch Available
Event History
Aug 23, 2013
CVE Published
via MITRE·04:00 PM
Data Sourced
via MITRE·04:00 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2013-1434?
CVE-2013-1434 has a high severity as it allows remote attackers to execute arbitrary SQL commands.
2
How do I fix CVE-2013-1434?
To fix CVE-2013-1434, upgrade Cacti to version 0.8.8b or later.
3
Which Cacti versions are affected by CVE-2013-1434?
CVE-2013-1434 affects Cacti versions prior to 0.8.8b, including versions 0.8.5 to 0.8.8a.
4
What impact does CVE-2013-1434 have on my Cacti installation?
The impact of CVE-2013-1434 includes the potential for database manipulation and unauthorized data access.
5
Are there any known exploits for CVE-2013-1434?
Yes, there are known exploits for CVE-2013-1434 that utilize the SQL injection vulnerabilities in the affected Cacti files.