CVE-2023-39361 — AI Deep Analysis Summary

🚨 **Essence**: Critical SQL Injection in Cacti's `graph_view.php`. 💥 **Consequences**: Attackers can modify the database, steal data, and potentially execute remote code (RCE).…

🛡️ **CWE-89**: Improper Neutralization of Special Elements used in an SQL Command. 🐛 **Flaw**: The `rfilter` parameter in the `grow_right_pane_tree` function is not properly sanitized.…

📦 **Product**: Cacti (Open-source network monitoring). 📅 **Affected**: All versions **before 1.2.24**. ✅ **Fixed**: Version 1.2.25 and later are safe.

🕵️ **Privileges**: Can usurp administrative privileges. 💾 **Data**: Extract sensitive info like `id`, `username`, and database contents. 🚀 **Impact**: Remote Code Execution (RCE) is possible via database manipulation.

⚠️ **Auth**: **NO Authentication Required!** 🌐 **Config**: Default settings allow 'guest' users to access `graph_view.php`. This makes the exploitation threshold **extremely low** and dangerous.

🔥 **Yes, Public Exploitation Exists**. 📂 **PoCs**: Available on GitHub (e.g., `vulhub`, `projectdiscovery/nuclei-templates`). 🧪 **Tools**: Nuclei templates are already published for automated scanning.

🔍 **Self-Check**: Scan for `graph_view.php` with `rfilter` parameter. 🛠️ **Tools**: Use Nuclei with the CVE-2023-39361 template. 📊 **Indicator**: Check if guest access is enabled and version < 1.2.24.

🩹 **Official Fix**: Upgrade to **Cacti 1.2.25** or newer. 📢 **Advisory**: See GHSA-6r43-q2fw-5wrg on GitHub. 🚫 **No Workarounds**: The vendor states there are no known safe workarounds other than patching.

🚧 **Mitigation**: If you cannot patch immediately, **disable guest user access** in Cacti settings. 🔒 **Network**: Restrict access to `graph_view.php` via firewall/WAF rules.…

🔴 **Priority: CRITICAL**. 📉 **CVSS**: 9.8 (High). 🚀 **Urgency**: Immediate action required. Since it's unauthenticated and affects default configs, automated bots are likely already scanning for this.