Critical · published May 13, 2024
CVSS calls it critical at 9.1. It sits in the 99.7th percentile for exploit probability.
🚨 An authenticated user with the right permissions can exploit an arbitrary file write vulnerability in Cacti, potentially executing malicious PHP code on your server! 🔥 Think of this like a hotel check-in process where anyone with a reservation can request to change the room number, and the staff never verify if they should! This oversight allows an attacker to overwrite files, slipping in unwanted extras under the radar. If exploited, this flaw could allow an attacker to write or overwrite critical files, leading to full control over the web server. Imagine a rogue guest taking over the hotel management software, potentially compromising sensitive data and system integrity. This is a critical vulnerability that demands immediate attention!
Think of this like a hotel check-in process where anyone with a reservation can request to change the room number, and the staff never verify if they should! This oversight allows an attacker to overwrite files, slipping in unwanted extras under the radar. The vulnerability exists in the `import_package()` function within `/lib/import.php`, which blindly trusts user-supplied filenames and XML content without proper validation, enabling an authenticated user with the 'Import Templates' permission to execute arbitrary PHP code.
If exploited, this flaw could allow an attacker to write or overwrite critical files, leading to full control over the web server. Imagine a rogue guest taking over the hotel management software, potentially compromising sensitive data and system integrity. This is a critical vulnerability that demands immediate attention! Immediately upgrade to Cacti version 1.2.27 or later to patch this vulnerability. Additionally, review user permissions and restrict the 'Import Templates' permission to trusted users only. Regularly audit your server for any unauthorized changes. You've got this! Patch up and keep your systems safe! 🛡️