CVE-2004-1737
published 2004-08-16CVE-2004-1737: SQL injection vulnerability in auth_login.php in Cacti 0.8.5a allows remote attackers to execute arbitrary SQL commands and bypass authentication via the (1)…
PriorityP344high7.5CVSS 2.0
AVNACLAuNCPIPAP
EXPLOIT
EPSS
2.83%
84.8th percentile
SQL injection vulnerability in auth_login.php in Cacti 0.8.5a allows remote attackers to execute arbitrary SQL commands and bypass authentication via the (1) username or (2) password parameters.
Affected
25 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| cacti | cacti | >= 0 < 0.8.5a-5 | 0.8.5a-5 |
| cacti | cacti | >= 0 < 0.8.5a-5 | 0.8.5a-5 |
| cacti | cacti | >= 0 < 0.8.5a-5 | 0.8.5a-5 |
| cacti | cacti | >= 0 < 0.8.5a-5 | 0.8.5a-5 |
| debian | cacti | < cacti 0.8.5a-5 (bookworm) | cacti 0.8.5a-5 (bookworm) |
| gentoo | linux | — | — |
| the_cacti_group | cacti | — | — |
| the_cacti_group | cacti | — | — |
| the_cacti_group | cacti | — | — |
| the_cacti_group | cacti | — | — |
| the_cacti_group | cacti | — | — |
| the_cacti_group | cacti | — | — |
| the_cacti_group | cacti | — | — |
| the_cacti_group | cacti | — | — |
| the_cacti_group | cacti | — | — |
| the_cacti_group | cacti | — | — |
| the_cacti_group | cacti | — | — |
| the_cacti_group | cacti | — | — |
| the_cacti_group | cacti | — | — |
| the_cacti_group | cacti | — | — |
| the_cacti_group | cacti | — | — |
| the_cacti_group | cacti | — | — |
| the_cacti_group | cacti | — | — |
| the_cacti_group | cacti | — | — |
| the_cacti_group | cacti | — | — |
CVSS provenance
nvdv2.07.5HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P
osv7.5HIGH
vendor_debian7.5HIGH
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Debian
CVE-2004-1737: cacti - SQL injection vulnerability in auth_login.php in Cacti 0.8.5a allows remote atta...
vendor_debian·2004·CVSS 7.5
CVE-2004-1737 [HIGH] CVE-2004-1737: cacti - SQL injection vulnerability in auth_login.php in Cacti 0.8.5a allows remote atta...
SQL injection vulnerability in auth_login.php in Cacti 0.8.5a allows remote attackers to execute arbitrary SQL commands and bypass authentication via the (1) username or (2) password parameters.
Scope: local
bookworm: resolved (fixed in 0.8.5a-5)
bullseye: resolved (fixed in 0.8.5a-5)
forky: resolved (fixed in 0.8.5a-5)
sid: resolved (fixed in 0.8.5a-5)
trixie: resolved (fixed in 0.8.5a-5)
GHSA
GHSA-v3h5-fhg8-jp65: SQL injection vulnerability in auth_login
ghsa_unreviewed·2022-04-29
CVE-2004-1737 [HIGH] GHSA-v3h5-fhg8-jp65: SQL injection vulnerability in auth_login
SQL injection vulnerability in auth_login.php in Cacti 0.8.5a allows remote attackers to execute arbitrary SQL commands and bypass authentication via the (1) username or (2) password parameters.
OSV
CVE-2004-1737: SQL injection vulnerability in auth_login
osv·2004-08-16·CVSS 7.5
CVE-2004-1737 [HIGH] CVE-2004-1737: SQL injection vulnerability in auth_login
SQL injection vulnerability in auth_login.php in Cacti 0.8.5a allows remote attackers to execute arbitrary SQL commands and bypass authentication via the (1) username or (2) password parameters.
No detection rules found.
http://lists.grok.org.uk/pipermail/full-disclosure/2004-August/025376.htmlhttp://marc.info/?l=bugtraq&m=109272483621038&w=2http://secunia.com/advisories/12308http://www.gentoo.org/security/en/glsa/glsa-200408-21.xmlhttp://www.securityfocus.com/bid/10960https://exchange.xforce.ibmcloud.com/vulnerabilities/17011http://lists.grok.org.uk/pipermail/full-disclosure/2004-August/025376.htmlhttp://marc.info/?l=bugtraq&m=109272483621038&w=2http://secunia.com/advisories/12308http://www.gentoo.org/security/en/glsa/glsa-200408-21.xmlhttp://www.securityfocus.com/bid/10960https://exchange.xforce.ibmcloud.com/vulnerabilities/17011
2004-08-16
Published