{"id":"CVE-2023-49084","published":"2023-12-21T23:04:44Z","modified":"2026-02-25T16:34:32Z","title":"Local File Inclusion (RCE) in Cacti","vendor":"Cacti","product":"cacti","tier":"core","eol":null,"affectedVersions":[{"vendor":"Cacti","product":"cacti","versions":["= 1.2.25"]}],"description":{"text":"Cacti is a robust performance and fault management framework and a frontend to RRDTool - a Time Series Database (TSDB). While using the detected SQL Injection and insufficient processing of the include file path, it is possible to execute arbitrary code on the server. Exploitation of the vulnerability is possible for an authorized user. The vulnerable component is the `link.php`. Impact of the vulnerability execution of arbitrary code on the server.","provenance":"source","from":"CVE.org"},"summary":{"text":"A flaw in Cacti, the performance and fault management framework and RRDTool frontend, lies in its link.php component, where insufficient processing of an include file path, combined with a detected SQL injection, allows the file path to be controlled. An attacker who is an authorized user, with network access to the instance and high privileges (as the attack vector requires), can exploit this to execute arbitrary code on the server.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-29T07:12:48Z"},"cvss":{"score":8.1,"severity":"HIGH","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.64448,"percentile":0.99234,"date":"2026-10-29","provenance":"source"},"kev":null,"vulncheckKev":null,"exploited":false,"otx":{"pulseCount":1,"pulses":[{"name":"GuLoader Malware Uses Noise and Obfuscation to Evade Detection","url":"https://otx.alienvault.com/pulse/6846ba5c476362a28199effa","created":"2025-06-09"}],"provenance":"machine"},"cwes":[{"id":"CWE-98","name":"Improper Control of Filename for Include/Require Statement in PHP Program"}],"references":[{"url":"https://github.com/Cacti/cacti/security/advisories/GHSA-pfh9-gwm6-86vp","tags":["x_refsource_CONFIRM"]},{"url":"http://packetstormsecurity.com/files/176995/Cacti-pollers.php-SQL-Injection-Remote-Code-Execution.html","tags":[]},{"url":"https://lists.debian.org/debian-lts-announce/2024/03/msg00018.html","tags":[]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RBEOAFKRARQHTDIYSL723XAFJ2Q6624X/","tags":[]}],"techniques":[],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2023-53099","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2023-53099","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[],"exploitSources":{"metasploit":[{"name":"Cacti RCE via SQLi in pollers.php","module":"exploit/multi/http/cacti_pollers_sqli_rce","type":"exploit","disclosureDate":"2023-12-20","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/cacti_pollers_sqli_rce.rb"}],"first":{"date":"2023-12-20","source":"Metasploit","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/cacti_pollers_sqli_rce.rb"},"provenance":"source"},"exploitRefs":["http://packetstormsecurity.com/files/176995/Cacti-pollers.php-SQL-Injection-Remote-Code-Execution.html"],"flow":[],"timeline":[{"date":"2023-12-20","kind":"exploit-public","label":"First public exploit: Metasploit","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/cacti_pollers_sqli_rce.rb","provenance":"source"},{"date":"2023-12-21","kind":"published","label":"Published (CVE.org)","url":"https://www.cve.org/CVERecord?id=CVE-2023-49084","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":"Metasploit","daysToKev":null},"priority":{"score":31.2,"factors":[{"name":"In a KEV catalog","points":0.0,"detail":"not listed"},{"name":"Recent KEV listing","points":0.0,"detail":"not listed"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.85,"detail":"percentile 0.9923"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"1 NVD exploit link; 1 Metasploit module"},{"name":"Mentioned in OTX pulses","points":0.68,"detail":"1 pulse"},{"name":"CVSS severity","points":5.67,"detail":"base score 8.1"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}