CVE-2016-3172: SQL Injection
Published Apr 12, 2016
·Updated
SQL injection vulnerability in tree.php in Cacti 0.8.8g and earlier allows remote authenticated users to execute arbitrary SQL commands via the parentid parameter in an itemedit action.
Affected Software
1 affected component
Cacti Cacti<=0.8.8g
Event History
Apr 12, 2016
CVE Published
via MITRE·04:00 PM
Data Sourced
via MITRE·04:00 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2016-3172?
CVE-2016-3172 is considered a high severity vulnerability due to its potential to allow remote execution of arbitrary SQL commands.
2
How do I fix CVE-2016-3172?
To fix CVE-2016-3172, users should upgrade Cacti to version 0.8.8h or later.
3
Who is affected by CVE-2016-3172?
CVE-2016-3172 affects remote authenticated users of Cacti versions up to and including 0.8.8g.
4
What type of vulnerability is CVE-2016-3172?
CVE-2016-3172 is categorized as an SQL injection vulnerability.
5
What exactly does the CVE-2016-3172 vulnerability exploit?
CVE-2016-3172 exploits the parent_id parameter in an item_edit action in the tree.php file.