CVE-2023-39359
Published: 05 September 2023
Summary
CVE-2023-39359 is a high-severity SQL Injection (CWE-89) vulnerability in Fedoraproject Fedora. Its CVSS base score is 8.8 (High).
Operationally, ranked in the top 9.5% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Deeper analysis
Cacti, an open source operational monitoring and fault management framework, contains an authenticated SQL injection vulnerability in the graphs.php file. The flaw occurs when the site_id parameter is supplied with a value greater than zero in the ajax_hosts and ajax_hosts_noany code paths, causing the value to be directly concatenated into the WHERE clause of an SQL statement without proper sanitization. This issue is tracked as CWE-89 and carries a CVSS 3.1 score of 8.8.
An authenticated user can exploit the injection to escalate privileges and achieve remote code execution on the affected Cacti instance. Because the attack requires only low-privileged credentials and no user interaction, an attacker with network access to the web interface can leverage the vulnerability to run arbitrary SQL commands that ultimately lead to command execution on the underlying server.
Official advisories, including the GitHub Security Advisory and subsequent distribution notices from Fedora and Debian, state that the issue is resolved in Cacti 1.2.25 and that no workarounds are available; administrators are therefore directed to upgrade promptly. The EPSS score has remained flat at 0.0558 since disclosure, indicating no material increase in observed exploitation interest.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2023-43085
Vulnerability details
Cacti is an open source operational monitoring and fault management framework. An authenticated SQL injection vulnerability was discovered which allows authenticated users to perform privilege escalation and remote code execution. The vulnerability resides in the `graphs.php` file. When dealing with…
more
the cases of ajax_hosts and ajax_hosts_noany, if the `site_id` parameter is greater than 0, it is directly reflected in the WHERE clause of the SQL statement. This creates an SQL injection vulnerability. This issue has been addressed in version 1.2.25. Users are advised to upgrade. There are no known workarounds for this vulnerability.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.