Cacti CVE-2023-39361 SQL注入漏洞

Description

PoC

None yet. Search at https://trap.biu.life/?ref=rss

References

• https://github.com/Cacti/cacti/security/advisories/GHSA-6r43-q2fw-5wrg
• https://avd.aliyun.com/detail?id=AVD-2023-39361
• https://cloud.tencent.com/developer/article/2330057
• https://nvd.nist.gov/vuln/detail/CVE-2023-39361
• https://access.redhat.com/security/cve/cve-2023-39361
• https://zhuanlan.zhihu.com/p/648828491
• https://cn-sec.com/archives/2020415.html
• https://cert.360.cn/warning/detail?id=64f9b81e22adc884abcd7ee2
• https://www.ucloud.cn/site/ucsafe/6533.html
• https://security.snyk.io/vuln/SNYK-ALPINE318-CACTI-6191289

Related Vulnerabilities

• PoCcacti-guest-access-enabled: Cacti - Guest User Access Enabled
• PoCcacti-log-exposure: Cacti Log - Exposure
• PoCcacti-fpd: Cacti - Full Path Disclosure
• PoCCVE-2020-8813: Cacti v1.2.8 - Remote Code Execution
• PoCCVE-2021-26247: Cacti - Cross-Site Scripting
• PoCCVE-2022-46169: Cacti <=1.2.22 - Remote Command Injection
• PoCCVE-2023-30534: Cacti < 1.2.25 Insecure Deserialization
• PoCCVE-2023-39361: Cacti 1.2.24 - SQL Injection
• PoCCVE-2024-29895: Cacti cmd_realtime.php - Command Injection
• PoCCVE-2022-46169: Cacti remote_agent.php 远程命令执行漏洞
• PoCcacti-weathermap-file-write: Cacti Weathermap File Write
• 浙大恩特客户资源管理系统 /entsoft/CrmBasicAction.entcrm 文件上传漏洞 （CNVD-2021-51371）