CVE-2020-14295

HIGH 7.2CVE-2020-14295 · Published 17/06/2020 · updated 17/06/2026

Package	Affected versions	Patched versions
cacti cacti	`= 1.2.12`	No fix yet

Description

A SQL injection issue in color.php in Cacti 1.2.12 allows an admin to inject SQL via the filter parameter. This can lead to remote command execution because the product accepts stacked queries.

References

lists.opensuse.org/opensuse-security-announce/2020-07/msg00067.html · Broken Link
lists.opensuse.org/opensuse-security-announce/2020-07/msg00085.html · Broken Link
packetstormsecurity.com/files/162384/Cacti-1.2.12-SQL-Injection-Remote-Code-Execution.html · Exploit
packetstormsecurity.com/files/162918/Cacti-1.2.12-SQL-Injection-Remote-Command-Execution.html · Exploit
Cacti/cacti · Exploit
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/W64CIB6L4HZRVQSWKPDDKXJO4J2XTOXD
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZKM5G3YNSZDHDZMPCMAHG5B5M2V4XYSE
security.gentoo.org/glsa/202007-03 · Third Party Advisory

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free