CVE-2020-14295
HIGHCacti 1.2.12 - Authenticated SQL Injection via color.php filter Parameter
Title source: llmExploitation Summary
EIP tracks 4 public exploits for CVE-2020-14295.
PoCs published by Leonardo Paiva, 0z09e, mrg3ntl3m4n, including Metasploit module exploits/unix/http/cacti_filter_sqli_rce.
AI-analyzed exploit summary This exploit leverages SQL injection in Cacti 1.2.12 via the 'filter' parameter to dump credentials and achieve remote code execution by modifying the 'path_php_binary' setting to execute a reverse shell.
Description
A SQL injection issue in color.php in Cacti 1.2.12 allows an admin to inject SQL via the filter parameter. This can lead to remote command execution because the product accepts stacked queries.
Exploits (4)
This exploit leverages SQL injection in Cacti 1.2.12 via the 'filter' parameter to dump credentials and achieve remote code execution by modifying the 'path_php_binary' setting to execute a reverse shell.
This exploit leverages an authenticated SQL injection in Cacti's `color.php` to achieve remote code execution by modifying the `path_php_binary` setting to execute a reverse shell. The PoC automates the process, including CSRF token extraction and payload delivery.
This is a functional exploit for CVE-2020-14295, which chains SQL injection with remote code execution in Cacti 1.2.12. It authenticates, injects a malicious payload to modify the PHP binary path, and triggers a reverse shell via netcat.
This Metasploit module exploits a SQL injection vulnerability in Cacti 1.2.12 and earlier, allowing an authenticated admin to execute arbitrary SQL queries and achieve remote code execution by modifying the `path_php_binary` setting.
References (8)
Scores
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H