Description
SQL injection vulnerability in config_settings.php for Cacti before 0.8.6e allows remote attackers to execute arbitrary SQL commands via the id parameter.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗Advisories 1
- DSA-764-1 cacti - several Debian Security (DSA / DLA) · Mar 9, 2026
References
- cacti-configsettings-sql-injection(21120) vdb-entry
- CLSA-2005:978 vendor-advisory
- http://www.cacti.net/release_notes_0_8_6e.php
- 20050622 Multiple Vendor Cacti Multiple SQL Injection Vulnerabilities third-party-advisory
- 17424 vdb-entry
- GLSA-200506-20 vendor-advisory
- DSA-764 vendor-advisory
- 1014252 vdb-entry
- 15931 third-party-advisory
- 15490 third-party-advisory
- 14027 vdb-entry