CVE-2004-1737
Cacti 0.8.5a - SQL Injection via Username or Password Parameter
Title source: llmExploitation Summary
EIP tracks 1 public exploit for CVE-2004-1737. PoCs published by Fernando Quintero.
AI-analyzed exploit summary This exploit demonstrates a SQL injection vulnerability in Cacti's auth_login.php script, allowing authentication bypass via a crafted username parameter. It also includes a secondary payload to execute arbitrary commands by inserting malicious data into the database, which is then executed via cmd.php.
Description
SQL injection vulnerability in auth_login.php in Cacti 0.8.5a allows remote attackers to execute arbitrary SQL commands and bypass authentication via the (1) username or (2) password parameters.
Exploits (1)
This exploit demonstrates a SQL injection vulnerability in Cacti's auth_login.php script, allowing authentication bypass via a crafted username parameter. It also includes a secondary payload to execute arbitrary commands by inserting malicious data into the database, which is then executed via cmd.php.