CVE-2020-8813

graph_realtime.php in Cacti 1.2.8 allows remote attackers to execute arbitrary OS commands via shell metacharacters in a cookie, if a guest user has the graph real-time privilege.

CVSS v3.1

8.8 HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CVSS v2.0

9.3 HIGHAV:N/AC:M/Au:N/C:C/I:C/A:C

EPSS

73.78% chance of exploitation in the next 30 days, 99th percentile

Nuclei

high · CWE-78

Published

2020-02-22

Updated

2024-08-04

Proof-of-concept exploits (7)

• https://drive.google.com/file/d/1A8hxTyk_NgSp04zPX-23nPbsSDeyDFio/view
• https://shells.systems/cacti-v1-2-8-authenticated-remote-code-execution-cve-2020-8813/
• 0xm4ud/Cacti-CVE-2020-88131★ · 2021-05-14
• hexcowboy/CVE-2020-88131★ · 2021-05-29
• m4udSec/Cacti-CVE-2020-88131★ · 2021-05-14
• mhaskar/CVE-2020-881367★ · 2020-02-22
• p0dalirius/CVE-2020-8813-Cacti-RCE-in-graph_realtime7★ · 2025-01-31

Nuclei templates (1)

• projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-8813.yaml

ExploitDB entries (2)

• https://www.exploit-db.com/exploits/48145
• https://www.exploit-db.com/exploits/48144

References

• CVE Record
• NVD entry

Related

• CVE-2015-3306
• CVE-2017-7494
• CVE-2018-20434
• CVE-2019-13024
• CVE-2019-15029
• CVE-2019-16662