CVE-2023-39357

Summary

CVE-2023-39357 is a vulnerability affecting the popular open-source monitoring tool, Cacti. The issue lies in the sql_save function, where user input is directly utilized when the column type is numeric. This lack of input validation in various files and functions calling sql_save has resulted in multiple SQL injection vulnerabilities. Authenticated users can exploit these weaknesses to execute privilege escalation and remote code execution. Users are urged to upgrade to Cacti version 1.2.25 as soon as possible, as there are currently no known workarounds for this vulnerability.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.