20040816 SQL Injection in CACTImailing list
http://lists.grok.org.uk/pipermail/full-disclosure/2004-August/025376.html CVE-2004-1737
RaXnet Cacti 0.6.x/0.8.x - 'Auth_Login.php' SQL Injection
Record summary
CVE-2004-1737 has a selected CVSS score of 7.5; EIP currently links 1 catalogued exploit.
Description
SQL injection vulnerability in auth_login.php in Cacti 0.8.5a allows remote attackers to execute arbitrary SQL commands and bypass authentication via the (1) username or (2) password parameters.
Description source: CVE List
Exploitation context
Available material
- Catalogued exploits
- 1
Proofs of concept
1Catalogued exploits
ExploitDBRaXnet Cacti 0.6.x/0.8.x - 'Auth_Login.php' SQL InjectionExploitDB exploitby Fernando QuinteroNot analyzed1 file
References
720040816 SQL Injection in CACTImailing list
http://marc.info/?l=bugtraq&m=109272483621038&w=2 12308Third-party advisory
http://secunia.com/advisories/12308 GLSA-200408-21Vendor advisory
http://www.gentoo.org/security/en/glsa/glsa-200408-21.xml 10960vdb entry
http://www.securityfocus.com/bid/10960 cacti-authlogin-sql-injection(17011)vdb entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/17011 nvd.nist.gov
https://nvd.nist.gov/vuln/detail/CVE-2004-1737