CVE-2024-29895
CRITICAL EXPLOITED NUCLEICacti 1.3.x DEV - Command Injection
Title source: llmExploitation Summary
CVE-2024-29895 has been observed exploited in the wild (reported by VulnCheck KEV). EIP tracks 6 public exploits from researchers including Stuub, apaz-dev, secunnix. A Nuclei detection template is also available.
AI-analyzed exploit summary This repository contains a functional Python script that exploits CVE-2024-29895, a command injection vulnerability in Cacti 1.3.x DEV. The exploit targets the `cmd_realtime.php` endpoint with a crafted GET request to achieve remote code execution.
Description
Cacti provides an operational monitoring and fault management framework. A command injection vulnerability on the 1.3.x DEV branch allows any unauthenticated user to execute arbitrary command on the server when `register_argc_argv` option of PHP is `On`. In `cmd_realtime.php` line 119, the `$poller_id` used as part of the command execution is sourced from `$_SERVER['argv']`, which can be controlled by URL when `register_argc_argv` option of PHP is `On`. And this option is `On` by default in many environments such as the main PHP Docker image for PHP. Commit 53e8014d1f082034e0646edc6286cde3800c683d contains a patch for the issue, but this commit was reverted in commit 99633903cad0de5ace636249de16f77e57a3c8fc.
Exploits (6)
This repository contains a functional Python script that exploits CVE-2024-29895, a command injection vulnerability in Cacti 1.3.x DEV. The exploit targets the `cmd_realtime.php` endpoint with a crafted GET request to achieve remote code execution.
The repository contains a functional Python PoC for CVE-2024-29895, a command injection vulnerability in Cacti 1.3.x dev branch. The exploit leverages the `poller_id` parameter in `cmd_realtime.php` to execute arbitrary commands when `register_argc_argv` is enabled.
This repository contains a functional exploit for CVE-2024-29895, a command injection vulnerability in Cacti. The exploit leverages the `register_argc_argv` PHP option being enabled to execute arbitrary commands via crafted HTTP requests to `/cacti/cmd_realtime.php`.
This repository contains a functional Python script that exploits CVE-2024-29895, a command injection vulnerability in Cacti 1.3.x DEV builds via the `cmd_realtime.php` endpoint. The exploit constructs a malicious GET request with a command injection payload and executes arbitrary commands on the target system.
This repository contains a functional exploit PoC for CVE-2024-29895, a command injection vulnerability in Cacti 1.3.x dev branch. The exploit leverages the `poller_id` parameter in `cmd_realtime.php` to execute arbitrary commands when `register_argc_argv` is enabled.
The repository contains a functional Python-based exploit for CVE-2024-29895, a command injection vulnerability in Cacti 1.3.x dev branch. The exploit leverages the `poller_id` parameter in `cmd_realtime.php` to execute arbitrary commands when `register_argc_argv` is enabled.
Nuclei Templates (1)
http.favicon.hash:-1797138069
icon_hash="-1797138069"
References (4)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H