what you don't know can hurt you

Register | Login

FilesNewsUsersAuthors

Home Files News &[SERVICES_TAB]About Contact Add New

Showing 1 - 1 of 1

Files from Aleksey Solovev

Cacti pollers.php SQL Injection / Remote Code Execution

Posted Feb 5, 2024

Authored by Christophe de la Fuente, Aleksey Solovev | Site metasploit.com

This Metasploit exploit module leverages sql injection and local file inclusion vulnerabilities in Cacti versions prior to 1.2.26 to achieve remote code execution. Authentication is needed and the account must have access to the vulnerable PHP script (pollers.php). This is granted by setting the Sites/Devices/Data permission in the General Administration section.

tags | exploit, remote, local, php, vulnerability, code execution, sql injection, file inclusion

advisories | CVE-2023-49084, CVE-2023-49085

SHA-256 | b4ef67908324e2b53eac068bc36847b4c86d487875706d6d2339e053cc3970f0

Download | Favorite | View