Skip to content

SQL Injection vulnerability when using form templates

Moderate
netniV published GHSA-jrxg-8wh8-943x May 12, 2024

Package

Cacti (PHP)

Affected versions

<= 1.2.26

Patched versions

1.2.27

Description

Summary

Some of the data stored in form_save() function in graph_template_inputs.php is not thoroughly checked and is used to concatenate the SQL statement in draw_nontemplated_fields_graph_item() function from lib/html_form_templates.php , finally resulting in SQL injection.

Details

In the SQL table graph_template_input stored in database, the column_name field is controllable. The writing of dirty data can be done from form_save() function in graph_template_inputs.php.
image

Storage does not require administrator privileges, while reading data to realize attack require administrator privileges.
In addition, the field length limit is 50.
image

The attack starts with the graph_edit() function in graphs.php. Calling draw_nontemplated_fields_graph_item() function.
image

Finally arriving at lib/html_form_templates.php. when reading the field data of table graph_template_input in database, variable $item is not checked and concatenated directly, resulting in SQL injection.
image
image

PoC

POST access graph_template_inputs.php and submit the following data:

  • '__csrf_magic'=> '',
  • 'action'=>'save',
  • 'save_component_input'=>1,
  • 'graph_template_input_id'=>1,
  • 'graph_template_id'=>1,
  • 'name'=>'FORSQLinjection',
  • 'description'=>'FORSQLinjection',
  • 'column_name'=>'id FROM host AS gti;DELETE FROM sessions WHERE 1;#'
    check field in automation_match_rule_items table.
    image

GET access : "http://ip:port/graphs.php?action=graph_edit&id=1".
Table session will delete data with id = 1.

Researcher: ISHGARD-2, USTC

Severity

Moderate
4.6
/ 10

CVSS base metrics

Attack vector
Network
Attack complexity
Low
Privileges required
Low
User interaction
Required
Scope
Unchanged
Confidentiality
None
Integrity
Low
Availability
Low
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:L

CVE ID

CVE-2024-31458

Weaknesses

No CWEs

Credits