CVE-2023-49085

Name of the Vulnerable Software and Affected Versions Cacti versions 1.2.25 and prior

Description The issue is related to a lack of protection in the SQL query structure of the Cacti network monitoring tool, specifically in the pollers.php script. This allows an authorized user to execute arbitrary SQL code, potentially leading to the execution of arbitrary code by a remote attacker. The vulnerable component is the pollers.php script. The impact of this issue is the execution of arbitrary SQL code.

Recommendations For versions 1.2.25 and prior, consider disabling the pollers.php script as a temporary workaround until a patch is available. Restrict access to the pollers.php script to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.