CVE-2015-8377

Name of the Vulnerable Software and Affected Versions Cacti versions 0.8.8f and earlier

Description The issue allows remote authenticated users to execute arbitrary SQL commands. This is achieved by sending crafted serialized data in the selected graphs array parameter in a save action, exploiting the host new graphs save function in graphs new.php.

Recommendations For versions 0.8.8f and earlier, update to a version that contains a fix for this issue. As a temporary workaround, consider restricting access to the host new graphs save function in graphs new.php to minimize the risk of exploitation. Avoid using the selected graphs array parameter in the affected save action until the issue is resolved.