CVE-2010-2545

Vulnerability

Cacti versions before 0.8.7g contain multiple cross-site scripting (XSS) flaws. An unauthenticated attacker can inject arbitrary web script or HTML via the name element in an XML template imported through templates_import.php [1][3]. Additionally, authenticated administrators can inject script via various object names or descriptions across numerous pages, including cdef.php, data_input.php, data_queries.php, data_sources.php, data_templates.php, gprint_presets.php, graph.php, graphs_new.php, graphs.php, graph_templates_inputs.php, graph_templates_items.php, graph_templates.php, graph_view.php, host.php, host_templates.php, lib/functions.php, lib/html_form.php, lib/html_form_template.php, lib/html.php, lib/html_tree.php, lib/rrd.php, rra.php, tree.php, and user_admin.php [1][2]. The persistent XSS is possible because user-supplied names and descriptions are not properly escaped before being stored and later displayed on these pages.

Exploitation

For the XML template vector, an attacker must trick an administrator with template import privileges into importing a maliciously crafted XML file containing a name element with embedded script [3]. For the authenticated vectors, the attacker requires administrative access to Cacti (or a lower-privileged user tricked into changing object names) and can then inject script into fields such as graph names, data source names, or host descriptions [1][2][3]. No special network position is needed beyond HTTP access to the Cacti web interface.

Impact

Successful exploitation allows an attacker to execute arbitrary JavaScript or HTML in the context of the Cacti web application. This can lead to session hijacking, data theft, or further compromise of the administrative interface. The attacker gains the privileges of the victim user viewing the malicious content; for the template import vector, the victim is typically an administrator [3]. The CIA impact is primarily confidentiality and integrity, as the attacker can steal sensitive data or perform actions on behalf of the victim.

Mitigation

The issue is fixed in Cacti version 0.8.7g, released on 2010-07-22 [3]. Users should upgrade to this version or later. The fixes were applied in Subversion revisions r6037, r6038, r6041, and r6042, which added HTML escaping to various output locations [2][3]. There is no known workaround; upgrading is required. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.