CVE-2020-14295: SQL Injection
First published: Wed Jun 17 2020(Updated: )
A SQL injection issue in color.php in Cacti 1.2.12 allows an admin to inject SQL via the filter parameter. This can lead to remote command execution because the product accepts stacked queries.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Cacti Cacti | =1.2.12 | |
| Fedoraproject Fedora | =31 | |
| Fedoraproject Fedora | =32 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00067.html
- http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00085.html
- http://packetstormsecurity.com/files/162384/Cacti-1.2.12-SQL-Injection-Remote-Code-Execution.html
- http://packetstormsecurity.com/files/162918/Cacti-1.2.12-SQL-Injection-Remote-Command-Execution.html
- https://github.com/Cacti/cacti/issues/3622
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/W64CIB6L4HZRVQSWKPDDKXJO4J2XTOXD/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZKM5G3YNSZDHDZMPCMAHG5B5M2V4XYSE/
- https://security.gentoo.org/glsa/202007-03
Frequently Asked Questions
What is CVE-2020-14295?
CVE-2020-14295 is a SQL injection issue in color.php in Cacti 1.2.12 that allows an admin to inject SQL via the filter parameter, leading to remote command execution.
What software versions are affected by CVE-2020-14295?
Cacti 1.2.12 and Fedoraproject Fedora 31 and 32 are affected by CVE-2020-14295.
What is the severity of CVE-2020-14295?
CVE-2020-14295 has a severity rating of 7.2 (high).
How can CVE-2020-14295 be exploited?
CVE-2020-14295 can be exploited by injecting SQL via the filter parameter in color.php.
Are there any references for CVE-2020-14295?
Yes, you can find references for CVE-2020-14295 at the following links: [1](http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00067.html), [2](http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00085.html), [3](http://packetstormsecurity.com/files/162384/Cacti-1.2.12-SQL-Injection-Remote-Code-Execution.html).
- collector/nvd-index
- vendor/cacti
- canonical/cacti cacti
- version/cacti cacti/1.2.12
- vendor/fedoraproject
- canonical/fedoraproject fedora
- version/fedoraproject fedora/31
- version/fedoraproject fedora/32