References https://avd.aliyun.com/detail?id=AVD-2022-46169 https://github.com/Threekiii/Awesome-POC/blob/master/Web%E5%BA%94%E7%94%A8%E6%BC%8F%E6%B4%9E/Cacti%20remote_agent.php%20%E5%89%8D%E5%8F%B0%E5%91%BD%E4%BB%A4%E6%B3%A8%E5%85%A5%E6%BC%8F%E6%B4%9E%20CVE-2022-46169.md https://xia0le.github.io/posts/cacti%E5%89%8D%E5%8F%B0rce-cve-2022-46169/ https://www.secrss.com/articles/49767 https://zhuanlan.zhihu.com/p/590425328 https://peiqi.wgpsec.org/wiki/webapp/Cacti/Cacti%20remote_agent.php%20%E8%BF%9C%E7%A8%8B%E5%91%BD%E4%BB%A4%E6%89%A7%E8%A1%8C%E6%BC%8F%E6%B4%9E%20CVE-2022-46169.html https://www.asiainfo-sec.com/security/notice/detail-6719.html https://nic.seu.edu.cn/info/1047/1342.htm https://www.h3c.com/cn/d_202302/1782194_30003_0.htm https://cert.360.cn/warning/detail?id=3ad298ed076f5033e94d987e490e575d https://nvd.nist.gov/vuln/detail/CVE-2022-46169 https://www.vicarius.io/vsociety/posts/unauthenticated-rce-in-cacti-cve-2022-46169 https://medium.com/@p00dl3/cve-2022-46169-unauthenticated-remote-code-execution-in-cacti-455d65b9012a https://www.venustech.com.cn/new_type/aqtg/20221207/24912.html https://stack.chaitin.com/vuldb/detail/27b23777-7e49-4249-8a03-3effae97b048 https://www.tenablecloud.cn/plugins/nessus/173897 https://zone.ci/aliyun/ali_highrisk/303668.html https://threatprotect.qualys.com/2023/01/19/cacti-unauthenticated-command-injection-vulnerability-cve-2022-46169/ https://pentest-tools.com/vulnerabilities-exploits/cacti-remote-code-execution_46 https://www.exploit-db.com/exploits/51166 https://nucleussec.com/blog/february-16-2023-cisa-kev-breakdown-cve-2022-46169-cacti/ https://github.com/Cacti/cacti/security/advisories/GHSA-6p93-p743-35gf https://github.com/vulhub/vulhub/blob/master/cacti/CVE-2022-46169/README.md https://www.sonarsource.com/blog/cacti-unauthenticated-remote-code-execution https://github.com/ariyaadinatha/cacti-cve-2022-46169-exploit
Related VulnerabilitiesPoCcacti-guest-access-enabled: Cacti - Guest User Access EnabledPoCcacti-log-exposure: Cacti Log - ExposurePoCcacti-fpd: Cacti - Full Path DisclosurePoCCVE-2020-8813: Cacti v1.2.8 - Remote Code ExecutionPoCCVE-2021-26247: Cacti - Cross-Site ScriptingPoCCVE-2022-46169: Cacti <=1.2.22 - Remote Command InjectionPoCCVE-2023-30534: Cacti < 1.2.25 Insecure DeserializationPoCCVE-2023-39361: Cacti 1.2.24 - SQL InjectionPoCCVE-2024-29895: Cacti cmd_realtime.php - Command InjectionPoCCVE-2022-46169: Cacti remote_agent.php 远程命令执行漏洞PoCcacti-weathermap-file-write: Cacti Weathermap File Write浙大恩特客户资源管理系统 /entsoft/CrmBasicAction.entcrm 文件上传漏洞 (CNVD-2021-51371)