CVE-2023-49084: cacti PHP Remote File Inclusion

Vulnerability summary

CVE-2023-49084 is a high (CVSS 8.8) PHP Remote File Inclusion vulnerability in cacti. EPSS estimates a 64.45% chance of exploitation in the next 30 days, higher than 99.2% of scored vulnerabilities. 2 public exploits are recorded.

Timeline

1. 21-12-2023
   PublishedVulnerability first disclosed.
2. 25-02-2026
   Last modifiedVulnerability information updated.

Description

Cacti is a robust performance and fault management framework and a frontend to RRDTool - a Time Series Database (TSDB). While using the detected SQL Injection and insufficient processing of the include file path, it is possible to execute arbitrary code on the server. Exploitation of the vulnerability is possible for an authorized user. The vulnerable component is the `link.php`. Impact of the vulnerability execution of arbitrary code on the server.

• CWE-98Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')The PHP application receives input from an upstream component, but it does not restrict or incorrectly restricts the input before its usage in "require," "include," or similar functions.