CVE-2023-49085

Cacti provides an operational monitoring and fault management framework. In versions 1.2.25 and prior, it is possible to execute arbitrary SQL code through the `pollers.php` script. An authorized user may be able to execute arbitrary SQL code. The vulnerable component is the `pollers.php`. Impact of the vulnerability - arbitrary SQL code execution. As of time of publication, a patch does not appear to exist.

• CWE-89

• http://packetstormsecurity.com/files/176995/Cacti-pollers.php-SQL-Injection-Remote-Code-Execution.html
• https://github.com/Cacti/cacti/blob/5f6f65c215d663a775950b2d9db35edbaf07d680/pollers.php#L451Exploit, Vendor Advisory
• https://github.com/Cacti/cacti/security/advisories/GHSA-vr3c-38wh-g855Exploit, Vendor Advisory
• https://lists.debian.org/debian-lts-announce/2024/03/msg00018.html
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RBEOAFKRARQHTDIYSL723XAFJ2Q6624X/
• http://packetstormsecurity.com/files/176995/Cacti-pollers.php-SQL-Injection-Remote-Code-Execution.html
• https://github.com/Cacti/cacti/blob/5f6f65c215d663a775950b2d9db35edbaf07d680/pollers.php#L451Exploit, Vendor Advisory
• https://github.com/Cacti/cacti/security/advisories/GHSA-vr3c-38wh-g855Exploit, Vendor Advisory
• https://lists.debian.org/debian-lts-announce/2024/03/msg00018.html
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RBEOAFKRARQHTDIYSL723XAFJ2Q6624X/

Published

Dec 22, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-4908Inappropriate implementation in Picture in Picture in Google…4.3
• CVE-2023-49080The Jupyter Server provides the backend (i.e. the core servi…4.3
• CVE-2023-49081aiohttp is an asynchronous HTTP client/server framework for …5.3
• CVE-2023-49082aiohttp is an asynchronous HTTP client/server framework for …5.3
• CVE-2023-49083cryptography is a package designed to expose cryptographic p…7.5
• CVE-2023-49084Cacti is a robust performance and fault management framework…8.8
• CVE-2023-49086Cacti is a robust performance and fault management framework…5.4
• CVE-2023-49087xml-security is a library that implements XML signatures and…7.5
• CVE-2023-49088Cacti is an open source operational monitoring and fault man…4.8
• CVE-2023-49089Umbraco is an ASP.NET content management system (CMS). Start…6.5
• CVE-2023-4909Inappropriate implementation in Interstitials in Google Chro…4.3
• CVE-2023-49090CarrierWave is a solution for file uploads for Rails, Sinatr…6.1