Description
config.php in Cacti 0.8.6e and earlier allows remote attackers to set the no_http_headers switch, then modify session information to gain privileges and disable the use of addslashes to conduct SQL injection attacks.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗Advisories 1
- DSA-764-1 cacti - several Debian Security (DSA / DLA) · Mar 9, 2026
References
- http://www.cacti.net/downloads/patches/0.8.6e/cacti-0.8.6f_security.patch
- http://www.hardened-php.net/advisory-052005.php
- 14130 vdb-entry
- [cacti-announce] 20050701 Cacti 0.8.6f Released mailing-list
- ADV-2005-0951 vdb-entry
- DSA-764 vendor-advisory
- 1014361 vdb-entry
- 20050702 Advisory 05/2005: Cacti Authentification/Addslashes Bypass Vulnerability mailing-list