EIP-2026-105680

PRE-CVE

Cacti 0.8.6i - 'copy_cacti_user.php' SQL Injection Create Admin

Title source: legacy

Exploitation Summary

EIP tracks 1 public exploit for EIP-2026-105680. PoCs published by rgod.

AI-analyzed exploit summary This exploit targets a SQL injection vulnerability in Cacti 0.8.6i's 'copy_cacti_user.php' script, allowing an attacker to create a new admin user by injecting malicious SQL via the 'template_user' argument when 'register_argc_argv' is enabled.

Description

Cacti 0.8.6i - 'copy_cacti_user.php' SQL Injection Create Admin

Exploits (1)

exploitdb WORKING POC VERIFIED

by rgod · phpwebappsphp

https://www.exploit-db.com/exploits/3045

View Code ZIP pw:eip

This exploit targets a SQL injection vulnerability in Cacti 0.8.6i's 'copy_cacti_user.php' script, allowing an attacker to create a new admin user by injecting malicious SQL via the 'template_user' argument when 'register_argc_argv' is enabled.

Classification

Working Poc 95%

Attack Type

Sqli

Complexity

Trivial

Reliability

Reliable

Target: Cacti 0.8.6i

No auth needed

Prerequisites: register_argc_argv enabled in PHP configuration · Cacti 0.8.6i installed

MITRE ATT&CK

T1189 - Drive-by Compromise T1190 - Exploit Public-Facing Application

devstral-2 · analyzed Feb 18, 2026 Full analysis →

Details

Status pre_cve

Tracked Since Feb 18, 2026