Description
SQL injection vulnerability in auth_login.php in Cacti before 0.8.7h allows remote attackers to execute arbitrary SQL commands via the login_username parameter.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | cacti | 0.8.7i-1 | — |
| Debian 13 | cacti | 0.8.7i-1 | — |
| Debian 12 | cacti | 0.8.7i-1 | — |
| Debian 6.0 | cacti | 0.8.7g-1+squeeze1 | DSA-2384-1 |
| Debian 5.0 | cacti | 0.8.7b-2.1+lenny4 | DSA-2384-1 |
Advisories 1
- DSA-2384-1 cacti - several Debian Security (DSA / DLA) · Mar 9, 2026
References
- http://bugs.cacti.net/view.php?id=2062
- 46876 third-party-advisory
- http://forums.cacti.net/viewtopic.php?f=21&t=44116
- 50671 vdb-entry
- http://www.cacti.net/release_notes_0_8_7h.php
- FEDORA-2011-15071 vendor-advisory
- http://svn.cacti.net/viewvc?view=rev&revision=6807
- FEDORA-2011-15110 vendor-advisory
- 44133 third-party-advisory
- cacti-unspecified-sql-injection(71326) vdb-entry
- FEDORA-2011-15032 vendor-advisory