CVE-2017-1000031

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

SQL injection vulnerability in graph_templates_inputs.php in Cacti 0.8.8b allows remote attackers to execute arbitrary SQL commands via the graph_template_input_id and graph_template_id parameters.

Metrics

CVSS 3.0 8.8/10CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-89

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://www.trustwave.com/Resources/Security-Advisories/Advisories/TWSL2016-007/?fid=7789Exploit, Mailing List, Third Party Advisory
https://www.trustwave.com/Resources/Security-Advisories/Advisories/TWSL2016-007/?fid=7789Exploit, Mailing List, Third Party Advisory

Timeline

Published: Jul 17, 2017
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2017

CVE-2017-10000326.1Cross-Site scripting (XSS) vulnerabilities in Cacti 0.8.8b allow remote attackers to inject arbitrary web script or HTML via the parent_id p CVE-2017-10000336.1Wordpress Plugin Vospari Forms version < 1.4 is vulnerable to a reflected cross site scripting in the form submission resulting in javascrip CVE-2017-10000348.1Akka versions <=2.4.16 and 2.5-M1 are vulnerable to a java deserialization attack in its Remoting component resulting in remote code executi CVE-2017-10000356.1Tiny Tiny RSS before 829d478f is vulnerable to XSS window.opener attack CVE-2017-10000379.8RVM automatically loads environment variables from files in $PWD resulting in command execution RVM vulnerable to command injection when aut CVE-2017-10000386.1WordPress plugin Relevanssi version 3.5.7.1 is vulnerable to stored XSS resulting in attacker being able to execute JavaScript on the affect CVE-2017-10000399.8Framadate version 1.0 is vulnerable to Formula Injection in the CSV Export resulting possible Information Disclosure and Code Execution CVE-2017-10000426.1Mapbox.js versions 1.x prior to 1.6.5 and 2.x prior to 2.1.7 are vulnerable to a cross-site-scripting attack in certain uncommon usage scena CVE-2017-10000436.1Mapbox.js versions 1.x prior to 1.6.6 and 2.x prior to 2.2.4 are vulnerable to a cross-site-scripting attack in certain uncommon usage scena CVE-2017-10000449.8gtk-vnc 0.4.2 and older doesn't check framebuffer boundaries correctly when updating framebuffer which may lead to memory corruption when re CVE-2017-10000467.5Mautic 2.6.1 and earlier fails to set flags on session cookies CVE-2017-10000479.8rbenv (all current versions) is vulnerable to Directory Traversal in the specification of Ruby version resulting in arbitrary code execution