CVE-2022-46169 PoC — Cacti 命令注入漏洞

Source

https://github.com/Inplex-sys/CVE-2022-46169

Associated Vulnerability

Title:Cacti 命令注入漏洞 (CVE-2022-46169)
Description:Cacti是Cacti团队的一套开源的网络流量监测和分析工具。该工具通过snmpget来获取数据，使用RRDtool绘画图形进行分析，并提供数据和用户管理功能。 Cacti v1.2.22版本存在命令注入漏洞，该漏洞源于未经身份验证的命令注入，允许未经身份验证的用户在运行Cacti的服务器上执行任意代码。

Description

Cacti Unauthenticated Command Injection

Readme

# CVE-2022-46169 (Cacti Command Injection)

This repo is part of the ***hgrab-framework***

### Affected product
  - Cacti prior to v1.2.22

### Installation
Install the app on the server
```sh
user@domain:~# git clone https://github.com/Inplex-sys/CVE-2022-46169.git
user@domain:~# cd ./CVE-2022-46169/
user@domain:~# python3 main.py <list.txt> <command>
```

The list file must contain the targets servers with this format `<http-https>://<target>:<port>/<uri-(optional)>`

File Snapshot


 [4.0K]  /data/pocs/525bc22102f466af3e3d68a90065abf6cba22aec
├── [ 11K]  LICENSE
├── [3.1K]  main.py
└── [ 475]  README.md

0 directories, 3 files

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. If the original source is unavailable, please email f.jinxu#gmail.com for a local snapshot (replace # with @).

3. Shenlong has snapshotted the POC code for you. To support long-term maintenance, please consider donating. Thank you for your support.

Goal Reached Thanks to every supporter — we hit 100%!