CVE-2023-51448

Cacti provides an operational monitoring and fault management framework. Version 1.2.25 has a Blind SQL Injection (SQLi) vulnerability within the SNMP Notification Receivers feature in the file `‘managers.php’`. An authenticated attacker with the “Settings/Utilities” permission can send a crafted HTTP GET request to the endpoint `‘/cacti/managers.php’` with an SQLi payload in the `‘selected_graphs_array’` HTTP GET parameter. As of time of publication, no patched versions exist.

Affected products

Alt Linux, Cacti

Cacti

= 1.2.25

CVSS 3.1

8.8 HIGH

EPSS

66.7% (99th percentile)

Weakness

CWE-89

NVD status

Modified

Published

2023-12-22

No exploit for CVE-2023-51448 has been indexed yet. Our index is built from live traffic and upstream syncs, so this page can only say what it knows — not that no exploit exists.