According to its self-reported version number, the Cacti application running on the remote web server is prior to version 0.8.6f. It is, therefore, potentially affected by the following vulnerabilities :

  - Multiple vulnerabilities exist due to improper input     validation in 'graph_image.php' and 'graph.php'.
    (CVE-2005-2148)

  - A flaw exists in 'config.php' that allows remote     attackers to set the 'no_http_headers' switch and then     modify session information in order to gain the     privileges necessary to perform SQL injection attacks.
    (CVE-2005-2149)

自己報告によるバージョン番号によると、リモート Web サーバー上で実行されている Cacti アプリケーションは、バージョン 0.8.6f 以前です。このため、以下の脆弱性の影響を受ける可能性があります。

- 「graph_image.php」および「graph.php」の中の入力検証が不適切なために、複数の脆弱性が存在します。
 (CVE-2005-2148)

- 「config.php」の中に欠陥が存在し、リモートの攻撃者が「no_http_headers」スイッチを設定してからセッション情報を変更することで、SQL インジェクション攻撃を実行するために必要な権限を獲得する可能性があります。
 (CVE-2005-2149)

根據其自我報告的版本號碼，遠端 Web 伺服器上執行的 Cacti 應用程式版本比 0.8.6f 舊。因此可能受到以下弱點影響：

- 存在多個因 ‘graph_image.php’ 和 ‘graph.php’ 中的不當輸入驗證所導致的弱點。
 (CVE-2005-2148)

- ‘config.php’ 中存在一個瑕疵，會允許遠端攻擊者設定 ‘no_http_headers’ 切換再修改工作階段資訊，藉此取得執行 SQL 插入攻擊所需要的權限。
 (CVE-2005-2149)

根据其自我报告的版本号，远程 Web 服务器上运行的 Cacti 应用程序低于版本 0.8.6f。因此，它可能会受到以下漏洞的影响：

- 由于未正确验证“graph_image.php”和“graph.php”的输入，存在多种漏洞。
 (CVE-2005-2148)

- “config.php”中存在缺陷，允许远程攻击者设置“no_http_headers”开关然后修改会话信息，从而获取执行 SQL 注入攻击的必要权限。
 (CVE-2005-2149)

Several vulnerabilities have been discovered in cacti, a round-robin database (RRD) tool that helps create graphs from database information. The Common Vulnerabilities and Exposures Project identifies the following problems :

  - CAN-2005-1524     Maciej Piotr Falkiewicz and an anonymous researcher     discovered an input validation bug that allows an     attacker to include arbitrary PHP code from remote sites     which will allow the execution of arbitrary code on the     server running cacti.

  - CAN-2005-1525

    Due to missing input validation cacti allows a remote     attacker to insert arbitrary SQL statements.

  - CAN-2005-1526

    Maciej Piotr Falkiewicz discovered an input validation     bug that allows an attacker to include arbitrary PHP     code from remote sites which will allow the execution of     arbitrary code on the server running cacti.

  - CAN-2005-2148

    Stefan Esser discovered that the update for the above     mentioned vulnerabilities does not perform proper input     validation to protect against common attacks.

  - CAN-2005-2149

    Stefan Esser discovered that the update for     CAN-2005-1525 allows remote attackers to modify session     information to gain privileges and disable the use of     addslashes to protect against SQL injection.

The Cacti application running on the remote web server is affected by an authentication bypass vulnerability.

ID	名稱	產品	系列	已發布	已更新	嚴重性
81602	Cacti < 0.8.6f Multiple Vulnerabilities	Nessus	CGI abuses	2015/3/3	2025/5/14	high
81602	Cacti < 0.8.6f の複数の脆弱性	Nessus	CGI abuses	2015/3/3	2025/5/14	high
81602	Cacti < 0.8.6f 多個弱點	Nessus	CGI abuses	2015/3/3	2025/5/14	high
81602	Cacti < 0.8.6f 多种漏洞	Nessus	CGI abuses	2015/3/3	2025/5/14	high
19258	Debian DSA-764-1 : cacti - several vulnerabilities	Nessus	Debian Local Security Checks	2005/7/21	2021/1/4	critical
18619	Cacti < 0.8.6f Authentication Bypass Vulnerability	Nessus	CGI abuses	2005/7/5	2025/5/14	high

偵測

搜尋 Plugin

high

high

high

high

critical

high