CVE-2020-14295

ALTO 7.2CVE-2020-14295 · Published 17/06/2020 · updated 17/06/2026

En resumen

CVE-2020-14295 es una vulnerabilidad ALTO (CVSS 7.2) que afecta a cacti (cacti).
Probabilidad de explotación en los próximos 30 días (EPSS): 86.1%, mayor que el 99.7% de las vulnerabilidades.
Aún no hay una versión corregida: sigue el aviso del fabricante en Referencias.

Package	Affected versions	Patched versions
cacti cacti	`= 1.2.12`	No fix yet

Description

A SQL injection issue in color.php in Cacti 1.2.12 allows an admin to inject SQL via the filter parameter. This can lead to remote command execution because the product accepts stacked queries.

References

lists.opensuse.org/opensuse-security-announce/2020-07/msg00067.html · Broken Link
lists.opensuse.org/opensuse-security-announce/2020-07/msg00085.html · Broken Link
packetstormsecurity.com/files/162384/Cacti-1.2.12-SQL-Injection-Remote-Code-Execution.html · Exploit
packetstormsecurity.com/files/162918/Cacti-1.2.12-SQL-Injection-Remote-Command-Execution.html · Exploit
Cacti/cacti · Exploit
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/W64CIB6L4HZRVQSWKPDDKXJO4J2XTOXD
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZKM5G3YNSZDHDZMPCMAHG5B5M2V4XYSE
security.gentoo.org/glsa/202007-03 · Third Party Advisory

Más vulnerabilidades de cacti

Ver todo →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free