Cacti 1.2.31 Security Bulletin: RCE, SQLi, XSS, Arbitrary File Read Fixes

Vulnerability Overview Cacti version 1.2.31 was released, fixing multiple security vulnerabilities including SQL injection, reflected XSS, arbitrary file read, and remote code execution. Affected Scope SQL Injection: Multiple parameters in files such as , , and are vulnerable to SQL injection. Reflected XSS: Vulnerabilities exist in and , among others. Arbitrary File Read: Vulnerabilities related to and the parameter allow for arbitrary file reading. Remote Code Execution (RCE): Vulnerabilities such as and enable remote code execution. Other Vulnerabilities: These include session fixation, signature verification bypass, Open Redirect, and pre-authentication SQL injection. Remediation SQL Injection: Strictly filter and escape input parameters; use prepared statements. Reflected XSS: Encode user input as HTML entities and avoid outputting it directly to the page. Arbitrary File Read: Restrict file paths to prevent directory traversal attacks. Remote Code Execution: Restrict plugin uploads and execution; ensure file content is safe. Other Vulnerabilities: Update session management, strengthen signature verification, and fix Open Redirect issues. POC Code No specific POC code or exploit code is provided in the release notes. Summary Cacti version 1.2.31 addresses multiple severe security vulnerabilities. Users are advised to upgrade to the latest version as soon as possible to ensure system security. For more details, refer to the README.

Goal Reached Thanks to every supporter — we hit 100%!

Cacti 1.2.31 Security Bulletin: RCE, SQLi, XSS, Arbitrary File Read Fixes

More from this source