CVE-2005-2148: the_cacti_group cacti
Vulnerability summary
CVE-2005-2148 is a high (CVSS 7.5) vulnerability in the_cacti_group cacti. EPSS estimates a 3.40% chance of exploitation in the next 30 days, higher than 88.7% of scored vulnerabilities.
Advisory lineage
Upstream 0 · Downstream 1Timeline
- 06-07-2005PublishedVulnerability first disclosed.
- 07-08-2024Last modifiedVulnerability information updated.
Description
Cacti 0.8.6e and earlier does not perform proper input validation to protect against common attacks, which allows remote attackers to execute arbitrary commands or SQL by sending a legitimate value in a POST request or cookie, then specifying the attack string in the URL, which causes the get_request_var function to return the wrong value in the $_REQUEST variable, which is cleansed while the original malicious $_GET value remains unmodified, as demonstrated in (1) graph_image.php and (2) graph.php.
CVSS metrics
1 score · 1 source · 1 versionEPSS trend
Probability
3.40%
Chance of exploitation in the next 30 days
Percentile
89%
Versus all other CVEs
30-day change
0.00 pp
From 3.40% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeNo weakness data has been published for this record.
Affected systems
Debian1 product
- cacti< 0.8.6f-1
The_cacti_group1 product
- cacti0.8 | 0.8.1 | 0.8.2 | 0.8.2a | 0.8.3 | 0.8.3a | 0.8.4 | 0.8.5 | 0.8.5a | 0.8.6 | 0.8.6a | 0.8.6b | 0.8.6c | 0.8.6d | 0.8.6e
2 vendors · 2 products
