Thewitness

**Name of the Vulnerable Software and Affected Versions** Cacti versions prior to 1.2.31 **Description** Cacti contains a Reflected XSS (Cross-Site Scripting) issue, where an attacker can execute malicious scripts in the victim's browser via the `html auth footer` function. **Recommendations** Update to version 1.2.31.

**Name of the Vulnerable Software and Affected Versions** Cacti versions prior to 1.2.31 **Description** An unauthenticated attacker can perform SQL injection on installations where guest graph viewing is enabled. The issue occurs because the `rfilter` request parameter is retrieved using the raw accessor `grv()` instead of `gfrv()` with `FILTER VALIDATE IS REGEX` validation. This parameter is then concatenated directly into RLIKE SQL clauses within `lib/html graph.php` and `lib/html tree.php`, which are accessible pre-authentication via the `graph view.php` endpoint. By using an unbalanced-quote payload to bypass regex validation, an attacker can inject arbitrary SQL to compromise the database's confidentiality, integrity, and availability. **Recommendations** Update to version 1.2.31. As a temporary mitigation, disable guest graph viewing to prevent unauthenticated access to the affected endpoint.

**Name of the Vulnerable Software and Affected Versions** Cacti versions prior to 1.2.31 **Description** Command Injection occurs due to insufficient sanitization in the `escape command()` function located at lib/rrd.php, which acts as a no-op by returning the `$command` unchanged. The command line constructed by `rrdtool function graph()` is passed through this function and subsequently executed via `shell exec($full commandline)`. The risk is present in ` rrd execute()`, where `text format` values from graph templates, potentially containing host variable substitutions, reach `shell exec` without proper escaping. **Recommendations** Update to version 1.2.31.

**Name of the Vulnerable Software and Affected Versions** Cacti versions prior to 1.2.31 **Description** Cacti is an open source performance and fault management framework. The software is subject to Session Fixation because the `session regenerate id()` function is not called after a successful login. In the login flow at the 'auth login.php' endpoint, the system directly sets the `$ SESSION[SESS USER ID]` variable without rotating the session ID. While session cookie configurations include httponly, samesite, and secure flags, these measures do not prevent session fixation via same-site vectors. **Recommendations** Update to version 1.2.31.

**Name of the Vulnerable Software and Affected Versions** Cacti (affected versions not specified) **Description** The issue allows Cacti authentication to be bypassed under certain LDAP conditions when using specific credential types. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: Cacti versions 1.2.x through 1.2.16 Description: A SQL injection issue in data debug.php allows remote authenticated attackers to execute arbitrary SQL commands via the `site id` parameter, potentially leading to remote code execution. Recommendations: For Cacti versions 1.2.x through 1.2.16, as a temporary workaround, consider restricting access to the `data debug.php` file until a patch is available. Avoid using the `site id` parameter in the affected endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.