CVE-2023-39359

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

Cacti is an open source operational monitoring and fault management framework. An authenticated SQL injection vulnerability was discovered which allows authenticated users to perform privilege escalation and remote code execution. The vulnerability resides in the `graphs.php` file. When dealing with the cases of ajax_hosts and ajax_hosts_noany, if the `site_id` parameter is greater than 0, it is directly reflected in the WHERE clause of the SQL statement. This creates an SQL injection vulnerability. This issue has been addressed in version 1.2.25. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-89

Affected software

No affected versions have been published.

Timeline

Published: Sep 5, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-39366.1The Blog2Social WordPress plugin before 7.2.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a R CVE-2023-393606.1Cacti is an open source operational monitoring and fault management framework.Affected versions are subject to a Stored Cross-Site-Scripting CVE-2023-393619.8Cacti is an open source operational monitoring and fault management framework. Affected versions are subject to a SQL injection discovered i CVE-2023-393627.2Cacti is an open source operational monitoring and fault management framework. In Cacti 1.2.24, under certain conditions, an authenticated p CVE-2023-393635.9Vyper is a Pythonic Smart Contract Language for the Ethereum Virtual Machine (EVM). In versions 0.2.15, 0.2.16 and 0.3.0, named re-entrancy CVE-2023-393645.4Cacti is an open source operational monitoring and fault management framework. In Cacti 1.2.24, users with console access can be redirected CVE-2023-393656.3Cacti is an open source operational monitoring and fault management framework. Issues with Cacti Regular Expression validation combined with CVE-2023-393664.8Cacti is an open source operational monitoring and fault management framework. Affected versions are subject to a Stored Cross-Site-Scriptin CVE-2023-393677.2An OS command injection vulnerability exists in the web interface mac2name functionality of Peplink Smart Reader v1.2.0 (in QEMU). A special CVE-2023-393686.5Protection mechanism failure of bus lock regulator for some Intel(R) Processors may allow an unauthenticated user to potentially enable deni CVE-2023-393696.1StarTrinity Softswitch version 2023-02-16 - Multiple Reflected XSS (CWE-79)CVE-2023-39374.8Cross site scripting vulnerability in web portal in Snow Software License Manager from version 9.0.0 up to and including 9.30.1 on Windows a