CVE-2020-8813

An attacker sends a crafted HTTP request to `graph_realtime.php` containing shell metacharacters (e.g., backticks, `$()`, semicolons) inside a cookie. If the Cacti instance is configured so that a guest user has the "graph real-time" privilege, no authentication is required. The server processes the cookie value without sanitization, passing it to a shell command, which executes the attacker's injected OS commands.

The vulnerability resides in `graph_realtime.php` in Cacti 1.2.8. The file reads a cookie value and passes it unsanitized into a command executed by the system shell, allowing shell metacharacters in the cookie to be interpreted as OS commands.

The bundle does not include a patch diff. The advisory [ref_id=1] indicates that Cacti addressed this issue in a later release (the changelog for v1.2.29 and later versions lists multiple security fixes, but CVE-2020-8813 is not explicitly called out in the provided changelog excerpts). The recommended remediation is to upgrade to a patched version of Cacti that properly escapes or validates cookie input before passing it to a shell command.