p PatchFirst

CVE-2005-10004

CVE-2005-10004 · Cacti graph_view.php RCE via graph_start Parameter Injection

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Cacti versions prior to 0.8.6-d contain a remote command execution vulnerability in the graph_view.php script. An authenticated user can inject arbitrary shell commands via the graph_start GET parameter, which is improperly handled during graph rendering. This flaw allows attackers to execute commands on the underlying operating system with the privileges of the web server process, potentially compromising system integrity.

CVSS 8.7 · High · EPSS 2.8% · Public exploit · Fix available

Published
Updated

Stack: system

Affected products and versions

  • cacti

    Versions
    • ≥ 0, < 0.8.6-d: Affected (semver)

    Update to 0.8.6-d

  • cacti Debian:12

    Affected ranges
    • ECOSYSTEM: < 0.8.6d-1

    Update to 0.8.6d-1

  • cacti Debian:13

    Affected ranges
    • ECOSYSTEM: < 0.8.6d-1

    Update to 0.8.6d-1

  • cacti Debian:14

    Affected ranges
    • ECOSYSTEM: < 0.8.6d-1

    Update to 0.8.6d-1

Original sources

Check your server →