关联漏洞
标题：
Cacti 命令注入漏洞
(CVE-2022-46169)
描述：Cacti是Cacti团队的一套开源的网络流量监测和分析工具。该工具通过snmpget来获取数据，使用RRDtool绘画图形进行分析，并提供数据和用户管理功能。 Cacti v1.2.22版本存在命令注入漏洞，该漏洞源于未经身份验证的命令注入，允许未经身份验证的用户在运行Cacti的服务器上执行任意代码。
描述
Unauthenticated Command Injection in Cacti <= 1.2.22
介绍
# CVE-2022-46169 PoC: Authentication Bypass and Remote Code Execution
This repository contains a PoC for the CVE-2022-46169 vulnerability, which allows an attacker to bypass authentication and execute arbitrary code remotely on the affected system. This vulnerability affects Cacti, version 1.2.22, released on August 18, 2022.
The vulnerability occurs due to `remote_agent.php` has a function to retrieves IP address and verify an entry within the `poller` table. If an entry was found, the function will return `true` and the client is authorized. One of the actions is called `polldata` which retrive few request parameter, if the `action` of a `poller_item` equals to `POLLER_ACTION_SCRIPT_PHP` can lead the attacker to execute command injection vulnerability through `proc_open`
The PoC demonstrates how an attacker can exploit this vulnerability to bypass authentication and execute arbitrary code remotely on the affected system.
## Requirement
* Python3
* Requests
## Usage
Make sure `X-Forwarded-For` value is within the `poller` table
You may change the `payload`
```
python3 cacti.py
```
## Disclaimer
This PoC is intended for educational and testing purposes only. Use of this PoC on any system or network without explicit permission from the system owner is illegal and may result in prosecution. The author assumes no liability for any damage caused by the use or misuse of this PoC. Use at your own risk.
## Reference
[CVE Details](https://www.cvedetails.com/cve/CVE-2022-46169/)
[Github](https://github.com/Cacti/cacti/security/advisories/GHSA-6p93-p743-35gf)
文件快照
[4.0K] /data/pocs/4b501b76a1271608f519736fc8c6573e8026e8d4
├── [1.9K] exploit.py
└── [1.6K] README.md
0 directories, 2 files
备注
1. 建议优先通过来源进行访问。
2. 如果因为来源失效或无法访问，请发送邮箱到 f.jinxu#gmail.com 索取本地快照（把 # 换成 @）。
3. 神龙已为您对POC代码进行快照，为了长期维护，请考虑为本地POC付费，感谢您的支持。