Vulnerability Details : CVE-2023-49084

Public exploit exists!
Cacti is a robust performance and fault management framework and a frontend to RRDTool - a Time Series Database (TSDB). While using the detected SQL Injection and insufficient processing of the include file path, it is possible to execute arbitrary code on the server. Exploitation of the vulnerability is possible for an authorized user. The vulnerable component is the `link.php`. Impact of the vulnerability execution of arbitrary code on the server.
Published 2023-12-21 23:15:09
Updated 2024-06-10 17:16:15
Source GitHub, Inc.
View at NVD,   CVE.org
Vulnerability category: Sql InjectionExecute code

Products affected by CVE-2023-49084

Exploit prediction scoring system (EPSS) score for CVE-2023-49084

EPSS FAQ
88.52%
Probability of exploitation activity in the next 30 days EPSS Score History
~ 99 %
Percentile, the proportion of vulnerabilities that are scored at or less

Metasploit modules for CVE-2023-49084

  • Cacti RCE via SQLi in pollers.php
    Disclosure Date: 2023-12-20
    First seen: 2024-02-09
    exploit/multi/http/cacti_pollers_sqli_rce
    This exploit module leverages a SQLi (CVE-2023-49085) and a LFI (CVE-2023-49084) vulnerability in Cacti versions prior to 1.2.26 to achieve RCE. Authentication is needed and the account must have access to the vulnerable PHP script (`pollers.php`). This is gr

CVSS scores for CVE-2023-49084

Base Score Base Severity CVSS Vector Exploitability Score Impact Score Score Source First Seen
8.8
 HIGH CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
2.8
5.9
 NIST
8.0
 HIGH CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H
1.3
6.0
 GitHub, Inc.

CWE ids for CVE-2023-49084

References for CVE-2023-49084

Jump to
This web site uses cookies for managing your session, storing preferences, website analytics and additional purposes described in our privacy policy.
By using this web site you are agreeing to CVEdetails.com terms of use!
Accept Close