CVE-2023-51448 : Security Advisory and Response

A SQL Injection vulnerability has been discovered in Cacti, affecting versions up to 1.2.25. This CVE allows an authenticated attacker to execute malicious SQL commands through crafted HTTP GET requests.

Understanding CVE-2023-51448

This section delves into the details of the SQL Injection vulnerability identified in Cacti.

What is CVE-2023-51448?

Cacti, a network monitoring tool, contains a Blind SQL Injection (SQLi) vulnerability in the SNMP Notification Receivers feature. By exploiting this flaw, an attacker with the appropriate permission can inject SQL commands using specially-crafted HTTP GET requests.

The Impact of CVE-2023-51448

This vulnerability has a CVSSv3 base score of 8.8 (High severity), with significant impacts on confidentiality, integrity, and availability. Attack vectors are low complexity over a network with minimal user interaction required.

Technical Details of CVE-2023-51448

This section provides a deep dive into the technical aspects of CVE-2023-51448.

Vulnerability Description

The vulnerability resides in the 'managers.php' file of Cacti version 1.2.25. Attackers can exploit the flaw by inserting malicious SQL payloads into the 'selected_graphs_array' HTTP GET parameter of the '/cacti/managers.php' endpoint.

Affected Systems and Versions

The SQL Injection vulnerability impacts Cacti versions up to 1.2.25. Users operating on these versions are at risk of exploitation by malicious actors.

Exploitation Mechanism

An authenticated attacker with the 'Settings/Utilities' permission can manipulate HTTP GET requests to execute SQL injection attacks. No official patches are available at the time of this publication.

Mitigation and Prevention

To safeguard systems from CVE-2023-51448, immediate actions and long-term security practices are essential.

Immediate Steps to Take

Users are advised to restrict access to the vulnerable feature, implement strict input validation, and closely monitor network traffic for malicious activity.

Long-Term Security Practices

Regular security assessments, timely software updates, and user awareness training on SQL Injection threats are critical for long-term security.

Patching and Updates

Users should regularly check for official patches and updates from Cacti to address the SQL Injection vulnerability in affected versions.