NVD

Id
67852  
Name
CVE-2005-2148  
Description
Cacti 0.8.6e and earlier does not perform proper input validation to protect against common attacks, which allows remote attackers to execute arbitrary commands or SQL by sending a legitimate value in a POST request or cookie, then specifying the attack string in the URL, which causes the get_request_var function to return the wrong value in the $_REQUEST variable, which is cleansed while the original malicious $_GET value remains unmodified, as demonstrated in (1) graph_image.php and (2) graph.php.  
Reject
 
CVSS Version
2  
CVSS Score
7.5  
Severity
High  
CVSS Base Score
7.5  
CVSS Impact Subscore
6.4  
CVSS Exploit Subscore
10  
CVSS Vector
(AV:N/AC:L/Au:N/C:P/I:P/A:P)  
Pub Date
2017-07-18  
Published
2005-07-06  
Modified Date
2017-07-10  
Seq
2005-2148  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
351094 67852 CVE-2005-2148 1014361  View
351095 67852 CVE-2005-2148 [cacti-announce] 20050701 Cacti 0.8.6f Released  View
351096 67852 CVE-2005-2148 http://www.cacti.net/downloads/patches/0.8.6e/cacti-0.8.6f_security.patch  View
351097 67852 CVE-2005-2148 DSA-764  View
351098 67852 CVE-2005-2148 http://www.hardened-php.net/advisory-032005.php  View
351099 67852 CVE-2005-2148 http://www.hardened-php.net/advisory-042005.php  View
351100 67852 CVE-2005-2148 20050702 Advisory 04/2005: Cacti Remote Command Execution Vulnerability  View
351101 67852 CVE-2005-2148 20050702 Advisory 03/2005: Cacti Multiple SQL Injection Vulnerabilities [FIXED]  View
351102 67852 CVE-2005-2148 14128  View
351103 67852 CVE-2005-2148 14129  View
351104 67852 CVE-2005-2148 ADV-2005-0951  View
351105 67852 CVE-2005-2148 cacti-graph-post-cookie-sql-injection(21266)  View
351106 67852 CVE-2005-2148 cacti-request-array-command-execution(21270)  View

Related JVN