CVEvulnerability
CVE-2020-14295
7.2 HIGH
Official page ↗
- Status
- Modified
- Published
- 2020-06-17
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 7.2 HIGH — CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
- CVSS 2.0 ([email protected])
- 6.5 MEDIUM — AV:N/AC:L/Au:S/C:P/I:P/A:P
- Weaknesses
- CWE-89
Description
A SQL injection issue in color.php in Cacti 1.2.12 allows an admin to inject SQL via the filter parameter. This can lead to remote command execution because the product accepts stacked queries.
Affected configurations
• cacti cacti 1.2.12
• fedoraproject fedora 31
• fedoraproject fedora 32
Related
Weakness · CWE (1)
- CWE-89 Improper Neutralization of Special Elements used in an SQL Command weakness
References
- http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00067.html Broken Link
- http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00085.html Broken Link
- http://packetstormsecurity.com/files/162384/Cacti-1.2.12-SQL-Injection-Remote-Code-Execution.html Exploit, Third Party Advisory, VDB Entry
- http://packetstormsecurity.com/files/162918/Cacti-1.2.12-SQL-Injection-Remote-Command-Execution.html Exploit, Third Party Advisory, VDB Entry
- https://github.com/Cacti/cacti/issues/3622 Exploit, Issue Tracking, Third Party Advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/W64CIB6L4HZRVQSWKPDDKXJO4J2XTOXD/ lists.fedoraproject.org
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZKM5G3YNSZDHDZMPCMAHG5B5M2V4XYSE/ lists.fedoraproject.org
- https://security.gentoo.org/glsa/202007-03 Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00067.html Broken Link
- http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00085.html Broken Link
- http://packetstormsecurity.com/files/162384/Cacti-1.2.12-SQL-Injection-Remote-Code-Execution.html Exploit, Third Party Advisory, VDB Entry
- http://packetstormsecurity.com/files/162918/Cacti-1.2.12-SQL-Injection-Remote-Command-Execution.html Exploit, Third Party Advisory, VDB Entry
- https://github.com/Cacti/cacti/issues/3622 Exploit, Issue Tracking, Third Party Advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/W64CIB6L4HZRVQSWKPDDKXJO4J2XTOXD/ lists.fedoraproject.org
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZKM5G3YNSZDHDZMPCMAHG5B5M2V4XYSE/ lists.fedoraproject.org
- https://security.gentoo.org/glsa/202007-03 Third Party Advisory