CVE-2022-46169 unauthenticated remote code execution

Description

• Authentication Bypass: a hostname-based authorization check is not implemented safely for most installations of Cacti
• Command Injection: unsanitized user input is propagated to a string used to execute an external command

Demo

POC

Install

Using go install

go install github.com/devAL3X/CVE-2022-46169_poc

Run the binary:

CVE-2022-46169_poc

Building mannually

Alternatively, you can build binarymannually:

First, ensure that you have Go installed on your machine and $GOPATH eviroment variable is set.

Clone the repository:

git clone https://github.com/devAL3X/CVE-2022-46169_poc.git

Change into the project directory:

cd CVE-2022-46169_poc

Build the binary:

go build

Run the binary:

./CVE-2022-46169_poc