Description
Cacti中存在跨站脚本漏洞。该漏洞是由于spikekill.php未对用户输入的数据做有效的验证导致的。
Cacti spikekill.php 跨站脚本攻击漏洞
PoC
None yet. Search at https://trap.biu.life/?ref=rssReferences
https://github.com/Cacti/cacti/issues/907
https://avd.aliyun.com/detail?id=AVD-2017-12927
https://nvd.nist.gov/vuln/detail/CVE-2017-12927
https://zone.ci/aliyun/ali_nvd/144407.html
https://seclists.org/oss-sec/2017/q3/328
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-12927
https://app.opencve.io/cve/?page=3&vendor=cacti
https://kenwu0310.wordpress.com/2017/08/21/cacti-1-1-19-released/
https://docs.cacti.net/Version-Specific-Release-Notes.md
https://www.tenable.com/plugins/nessus/102548