Signature Detail
Short Name |
HTTP:PHP:RAXNET-CACTI-RCE |
|---|---|
Severity |
Medium |
Recommended |
No |
Recommended Action |
Drop |
Category |
HTTP |
Keywords |
RaXnet Cacti Graph_Image.PHP Remote Command Execution |
Release Date |
2011/10/31 |
Update Number |
2019 |
Supported Platforms |
idp-4.0+, isg-3.0+, j-series-9.5+, mx-9.4+, srx-9.2+, srx-branch-9.4+, vsrx-12.1+ |
HTTP: RaXnet Cacti Graph_Image.PHP Remote Command Execution
This signature detects attempts to exploit a known vulnerability in the RaXnet Cacti Graph_Image.PHP. It is due to insufficient validation of user-supplied input. A remote attacker can exploit this by enticing a target to open a malicious URL link. A successful attack can result in remote command execution.
Extended Description
Cacti is prone to a remote command execution vulnerability. User-supplied input to the 'graph_image.php' script is not properly sanitized and allows attackers to execute arbitrary commands in the context of the server. This can facilitate various attacks including unauthorized access to an affected computer. Cacti 0.8.6d and prior versions are reportedly affected.
Affected Products
- Raxnet Cacti 0.5.0
- Raxnet Cacti 0.6.0
- Raxnet Cacti 0.6.1
- Raxnet Cacti 0.6.2
- Raxnet Cacti 0.6.3
- Raxnet Cacti 0.6.4
- Raxnet Cacti 0.6.5
- Raxnet Cacti 0.6.6
- Raxnet Cacti 0.6.7
- Raxnet Cacti 0.6.8
- Raxnet Cacti 0.6.8 a
- Raxnet Cacti 0.8.0
- Raxnet Cacti 0.8.1
- Raxnet Cacti 0.8.2
- Raxnet Cacti 0.8.2 a
- Raxnet Cacti 0.8.3
- Raxnet Cacti 0.8.3 a
- Raxnet Cacti 0.8.4
- Raxnet Cacti 0.8.5
- Raxnet Cacti 0.8.5 a
- Raxnet Cacti 0.8.6
- Raxnet Cacti 0.8.6 a
- Raxnet Cacti 0.8.6 b
- Raxnet Cacti 0.8.6 c
- Raxnet Cacti 0.8.6 d
References
- BugTraq: 14042