High severity8.8NVD Advisory· Published Dec 22, 2023· Updated Jun 17, 2026
CVE-2023-49085
CVE-2023-49085
Description
Cacti provides an operational monitoring and fault management framework. In versions 1.2.25 and prior, it is possible to execute arbitrary SQL code through the pollers.php script. An authorized user may be able to execute arbitrary SQL code. The vulnerable component is the pollers.php. Impact of the vulnerability - arbitrary SQL code execution. As of time of publication, a patch does not appear to exist.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
10<= 1.2.25+ 2 more
- (no CPE)range: <= 1.2.25
- (no CPE)range: <=1.2.25
- cpe:2.3:a:cacti:cacti:*:*:*:*:*:*:*:*range: <=1.2.25
- osv-coords7 versionspkg:rpm/suse/cacti&distro=SUSE%20Package%20Hub%2012pkg:rpm/suse/cacti-spine&distro=SUSE%20Package%20Hub%2015%20SP5pkg:rpm/opensuse/cacti&distro=openSUSE%20Tumbleweedpkg:rpm/opensuse/cacti&distro=openSUSE%20Leap%2015.5pkg:rpm/suse/cacti-spine&distro=SUSE%20Package%20Hub%2012pkg:rpm/suse/cacti&distro=SUSE%20Package%20Hub%2015%20SP5pkg:rpm/opensuse/cacti-spine&distro=openSUSE%20Leap%2015.5
< 1.2.26-bp155.2.6.1+ 6 more
- (no CPE)range: < 1.2.26-bp155.2.6.1
- (no CPE)range: < 1.2.26-bp155.2.6.1
- (no CPE)range: < 1.2.26-1.1
- (no CPE)range: < 1.2.26-bp155.2.6.1
- (no CPE)range: < 1.2.26-bp155.2.6.1
- (no CPE)range: < 1.2.26-bp155.2.6.1
- (no CPE)range: < 1.2.26-bp155.2.6.1
Patches
Vulnerability mechanics
References
5- github.com/Cacti/cacti/blob/5f6f65c215d663a775950b2d9db35edbaf07d680/pollers.phpnvdExploitVendor Advisory
- github.com/Cacti/cacti/security/advisories/GHSA-vr3c-38wh-g855nvdExploitVendor Advisory
- packetstormsecurity.com/files/176995/Cacti-pollers.php-SQL-Injection-Remote-Code-Execution.htmlnvd
- lists.debian.org/debian-lts-announce/2024/03/msg00018.htmlnvd
- lists.fedoraproject.org/archives/list/[email protected]/message/RBEOAFKRARQHTDIYSL723XAFJ2Q6624X/nvd
News mentions
0No linked articles in our index yet.