CVE-2009-4032

Vulnerability

Cacti 0.8.7e contains multiple reflected cross-site scripting (XSS) vulnerabilities due to improper sanitization of user-supplied input in graph.php, include/top_graph_header.php, lib/html_form.php, and lib/timespan_settings.php. The affected parameters include graph_end and graph_start in graph.php, date1 in a tree action to graph_view.php, and page_refresh and default_dual_pane_width in graph_settings.php. Versions up to and including 0.8.7e are vulnerable [2][4].

Exploitation

An attacker can exploit these vulnerabilities by crafting a malicious URL containing script payloads in the vulnerable parameters and tricking an authenticated Cacti user into visiting that URL. No additional privileges or authentication are required to craft the URL; only the victim must be logged into the Cacti application. Upon viewing the crafted page, the script executes in the context of the victim's session [2].

Impact

Successful exploitation allows an attacker to execute arbitrary JavaScript in the victim's browser, leading to session hijacking, data theft, or further compromise of the Cacti instance. The attack operates within the security context of the authenticated user's session [2].

Mitigation

The vendor addressed these issues in Cacti 0.8.7f, released in 2010. Users should upgrade to 0.8.7f or later. If upgrading is not immediately possible, administrators should restrict access to trusted users and review available patches from the Cacti project [2].