Vulnerability Information
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
N/A
Vulnerability Description
Cacti 0.8.6e and earlier does not perform proper input validation to protect against common attacks, which allows remote attackers to execute arbitrary commands or SQL by sending a legitimate value in a POST request or cookie, then specifying the attack string in the URL, which causes the get_request_var function to return the wrong value in the $_REQUEST variable, which is cleansed while the original malicious $_GET value remains unmodified, as demonstrated in (1) graph_image.php and (2) graph.php.
CVSS Information
N/A
Vulnerability Type
N/A
Vulnerability Title
Cacti 输入验证漏洞
Vulnerability Description
Cacti是一款轮循数据库(RRD)工具，可帮助从数据库信息创建图形。 Cacti 0.8.6e及之前版本中存在实现上存在输入验证漏洞。 由于没有正确校验用户输入，远程攻击者可通过POST请求或cookie，将攻击代码放置于URL内，这将导致get_request_var函数从$_REQUEST返回错误的值，攻击者利用此漏洞可在服务器上执行任意命令或SQL操作。
CVSS Information
N/A
Vulnerability Type
N/A