CVE-2020-14295: SQL Injection
A SQL injection issue in color.php in Cacti 1.2.12 allows an admin to inject SQL via the filter parameter. This can lead to remote command execution because the product accepts stacked queries.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
alpine/cactito a version that resolves this vulnerability.Fixed in 1.2.13-r0 - Upgrade
Upgrade
ubuntu/cactito a version that resolves this vulnerability.Fixed in 1.1.38+ds1-1ubuntu0.1~esm1 - Upgrade
Upgrade
ubuntu/cactito a version that resolves this vulnerability.Fixed in 1.2.10+ds1-1ubuntu1+esm1
Event History
Frequently Asked Questions
What is CVE-2020-14295?
CVE-2020-14295 is a SQL injection issue in color.php in Cacti 1.2.12 that allows an admin to inject SQL via the filter parameter, leading to remote command execution.
What software versions are affected by CVE-2020-14295?
Cacti 1.2.12 and Fedoraproject Fedora 31 and 32 are affected by CVE-2020-14295.
What is the severity of CVE-2020-14295?
CVE-2020-14295 has a severity rating of 7.2 (high).
How can CVE-2020-14295 be exploited?
CVE-2020-14295 can be exploited by injecting SQL via the filter parameter in color.php.
Are there any references for CVE-2020-14295?
Yes, you can find references for CVE-2020-14295 at the following links: [1](http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00067.html), [2](http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00085.html), [3](http://packetstormsecurity.com/files/162384/Cacti-1.2.12-SQL-Injection-Remote-Code-Execution.html).