CVE-2010-2092
27.05.2010, 22:30
SQL injection vulnerability in graph.php in Cacti 0.8.7e and earlier allows remote attackers to execute arbitrary SQL commands via a crafted rra_id parameter in a GET request in conjunction with a valid rra_id value in a POST request or a cookie, which causes the POST or cookie value to bypass the validation routine, but inserts the $_GET value into the resulting query.
| Vendor | Product | Version |
|---|---|---|
| cacti | cacti | 𝑥 ≤ 0.8.7e |
| cacti | cacti | 0.5 |
| cacti | cacti | 0.6 |
| cacti | cacti | 0.6.1 |
| cacti | cacti | 0.6.2 |
| cacti | cacti | 0.6.3 |
| cacti | cacti | 0.6.4 |
| cacti | cacti | 0.6.5 |
| cacti | cacti | 0.6.6 |
| cacti | cacti | 0.6.7 |
| cacti | cacti | 0.6.8 |
| cacti | cacti | 0.6.8a:a |
| cacti | cacti | 0.8 |
| cacti | cacti | 0.8.1 |
| cacti | cacti | 0.8.2 |
| cacti | cacti | 0.8.2a:a |
| cacti | cacti | 0.8.3 |
| cacti | cacti | 0.8.3a:a |
| cacti | cacti | 0.8.4 |
| cacti | cacti | 0.8.5 |
| cacti | cacti | 0.8.5a:a |
| cacti | cacti | 0.8.6 |
| cacti | cacti | 0.8.6a:a |
| cacti | cacti | 0.8.6b:b |
| cacti | cacti | 0.8.6c:c |
| cacti | cacti | 0.8.6d:d |
| cacti | cacti | 0.8.6f:f |
| cacti | cacti | 0.8.6g:g |
| cacti | cacti | 0.8.6h:h |
| cacti | cacti | 0.8.6i:i |
| cacti | cacti | 0.8.6j:j |
| cacti | cacti | 0.8.6k:k |
| cacti | cacti | 0.8.7 |
| cacti | cacti | 0.8.7a:a |
| cacti | cacti | 0.8.7b:b |
| cacti | cacti | 0.8.7c:c |
| cacti | cacti | 0.8.7d:d |
𝑥
= Vulnerable software versions
Debian Releases
Ubuntu Releases
References