CVE-2020-14295

A SQL injection issue in color.php in Cacti 1.2.12 allows an admin to inject SQL via the filter parameter. This can lead to remote command execution because the product accepts stacked queries.

CVSS v3.1

7.2 HIGHCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

CVSS v2.0

6.5 MEDIUMAV:N/AC:L/Au:S/C:P/I:P/A:P

EPSS

86.33% chance of exploitation in the next 30 days, 100th percentile

Nuclei

high · CWE-89

Published

2020-06-17

Updated

2024-08-04

Proof-of-concept exploits (4)

• http://packetstormsecurity.com/files/162384/Cacti-1.2.12-SQL-Injection-Remote-Code-Execut…
• http://packetstormsecurity.com/files/162918/Cacti-1.2.12-SQL-Injection-Remote-Command-Exe…
• 0z09e/CVE-2020-142952★ · 2021-04-29
• mrg3ntl3m4n/CVE-2020-142950★ · 2021-05-28

Nuclei templates (1)

• linuxadi/40k-nuclei-templates/blob/main/aditya/folder1/CVE-2020-14295.yaml

Metasploit modules (1)

• rapid7/metasploit-framework/blob/master/modules/exploits/unix/http/cacti_filter_sqli_rce.…

ExploitDB entries (1)

• https://www.exploit-db.com/exploits/49810

Exploit collections (1)

• tzwlhack/Vulnerability/blob/main/Cacti%20SQL%20%E6%B3%A8%E5%85%A5%E6%BC%8F%E6%B4%9E%EF%BC…

References

• CVE Record
• NVD entry

Related

• CVE-2020-35846
• CVE-2022-22909
• CVE-2020-14294
• CVE-2020-14315
• CVE-2020-14293
• CVE-2020-14321