When viewing graphs, some input variables are not properly checked (SQL injection possible) #3025

Activity

1. cigamit

   added

   bugUndesired behaviourUndesired behaviour

   SECURITYA security issue reported through CVEA security issue reported through CVE

   on Oct 12, 2019
2. cigamit

   added this to the v1.2.8 milestone on Oct 12, 2019
3. cigamit

   added

   resolvedA fixed issueA fixed issue

   on Oct 12, 2019
4. cigamit

   added a commit that references this issue on Oct 12, 2019

   Resolving Issue #3025

   ...

   d6dc485
5. cigamit

   closed this as completedon Oct 12, 2019
6. netniV

   changed the title [-]SQL Injection in graphs.php[/-] [+]When viewing graphs, some input variables are not properly checked (SQL injection possible)[/+] on Dec 7, 2019
7. carnil commented on Dec 10, 2019

   

   carnil

   on Dec 10, 2019

   More actions

   This was assigned CVE-2019-17357.
8. hlef commented on Dec 29, 2019

   

   hlef

   on Dec 29, 2019

   Last edited by hlef

   More actions

   @cigamit do you have instructions for reproducing this issue?

   Looking at the source code, I am pretty sure that cacti v0.8.8h from Debian Stretch isn't affected, but I would still like to try reproducing the injection.
9. netniV commented on Dec 30, 2019

   

   netniV

   on Dec 30, 2019

   Member

   More actions

   Just look for a similar section of code in the same php file from 0.8.8. If it uses it in the sQL statement without verifying the number is number, it is affected and needs the same patch.
10. TheWitness commented on Jan 2, 2020

    

    TheWitness

    on Jan 2, 2020

    Member

    More actions

    It has no impact to 0.8.x.
11. github-actions

    locked and limited conversation to collaborators on Jun 30, 2020