SQL Injection (SQLi)

2023-12-2719:38:02

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

sql injection

cacti:sid

managers.php

snmp notification

vulnerability

CVSS3

8.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

AI Score

7.7

Confidence

High

EPSS

0.001

Percentile

42.8%

JSON

cacti:sid is a vulnerable of SQL Injection (SQLi). The vulnerability due to receiving feature of SNMP Notification in the file ‘managers.php’. It leads to SQL Injection by allows the authenticated attacker with the “Settings/Utilities” permission can send a crafted HTTP GET request to the endpoint ‘/cacti/managers.php’ with an SQLi payload in the ‘selected_graphs_array’ HTTP GET parameter.