Cacti 0.8.7e and earlier allows remote authenticated administrators to gain privileges by modifying the "Data Input Method" for the "Linux - Get Memory Usage" setting to contain arbitrary commands.
SQL injection vulnerability in authlogin.php in Cacti before 0.8.7h allows remote attackers to execute arbitrary SQL commands via the loginusername parameter.
Description of problem:
Lack of input saintization can reportedly [1] [2] compose XSS, SQL injection or HTTP response splitting attack vector.
[1] http://www.cacti.net/releasenotes087b.php [2] http://secunia.com/advisories/28872/
Cacti before 0.8.7f, as used in Red Hat High Performance Computing (HPC) Solution and other products, allows remote authenticated administrators to execute arbitrary commands via shell metacharacters in (1) the FQDN field of a Device or (2) the Vertical Label field of a Graph Template.
graph.php in Cacti 0.8.7 before 0.8.7b and 0.8.6 before 0.8.6k allows remote attackers to obtain the full path via an invalid localgraphid parameter and other unspecified vectors.
Cross-site scripting (XSS) vulnerability in include/topgraphheader.php in Cacti before 0.8.7g allows remote attackers to inject arbitrary web script or HTML via the graphstart parameter to graph.php. NOTE: this vulnerability exists because of an incorrect fix for CVE-2009-4032.2.b.
Cross-site scripting (XSS) vulnerability in utilities.php in Cacti before 0.8.7g, as used in Red Hat High Performance Computing (HPC) Solution and other products, allows remote attackers to inject arbitrary web script or HTML via the filter parameter.
Description:
templatesimport.php does not filter html metacharacters when importing xml template files. This may cause a persistent cross-site scripting when importing templates from untrusted sources.
How to reproduce:
/cacti/templatesimport.php:
Import a template file with a specially crafted <name>...</name> tag, such as shown here.
<cacti> <hash000016fe5edd777a76d48fc48c11aded5211ef> <name> Unix - Load Average<![CDATA[<script>alert(document.cookie)</script>]]> </name> ...
Multiple cross-site scripting (XSS) vulnerabilities in Cacti before 0.8.7f, as used in Red Hat High Performance Computing (HPC) Solution and other products, allow remote attackers to inject arbitrary web script or HTML via the (1) hostname or (2) description parameter to host.php, or (3) the hostid parameter to datasources.php.
Cross-site request forgery (CSRF) vulnerability in logout.php in Cacti before 0.8.7i allows remote attackers to hijack the authentication of unspecified victims via unknown vectors.
CRLF injection vulnerability in Cacti 0.8.7 before 0.8.7b and 0.8.6 before 0.8.6k, when running on older PHP interpreters, allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via unspecified vectors.
Multiple cross-site scripting (XSS) vulnerabilities in Cacti 0.8.7 before 0.8.7b and 0.8.6 before 0.8.6k allow remote attackers to inject arbitrary web script or HTML via (1) the viewtype parameter to graph.php; (2) the filter parameter to graphview.php; (3) the action parameter to the drawnavigationtext function in lib/functions.php, reachable through index.php (aka the login page) or datainput.php; or (4) the loginusername parameter to index.php.