CVE-2023-39359

Summary

CVE-2023-39359 is an authenticated SQL injection vulnerability affecting the Cacti monitoring framework. Malicious users can exploit this flaw in the `graphs.php` file, leading to privilege escalation and remote code execution. This vulnerability arises when the `site_id` parameter is reflected in the SQL statement's WHERE clause without proper sanitization. Users are urged to upgrade to version 1.2.25 to mitigate the risk, as no workarounds are known to exist.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.