CVE-2024-29895 PoC — Cacti command injection in cmd_realtime.php

Source

https://github.com/Rubioo02/CVE-2024-29895

Associated Vulnerability

Title:Cacti command injection in cmd_realtime.php (CVE-2024-29895)
Description:Cacti provides an operational monitoring and fault management framework. A command injection vulnerability on the 1.3.x DEV branch allows any unauthenticated user to execute arbitrary command on the server when `register_argc_argv` option of PHP is `On`. In `cmd_realtime.php` line 119, the `$poller_id` used as part of the command execution is sourced from `$_SERVER['argv']`, which can be controlled by URL when `register_argc_argv` option of PHP is `On`. And this option is `On` by default in many environments such as the main PHP Docker image for PHP. Commit 53e8014d1f082034e0646edc6286cde3800c683d contains a patch for the issue, but this commit was reverted in commit 99633903cad0de5ace636249de16f77e57a3c8fc.

Description

CVE-2024-29895 | RCE on CACTI 1.3.X dev

Readme

# CVE-2024-29895 - RCE ON CACTI

> [!WARNING]  
> This is an educational project, I am not responsible for any use

## Usage:

`python3 poc.py -c whoami [-u https://localhost] [-f urls.txt]`

## CVE-2024-29895
CVE-2024-29895, Is a command injection vulnerability on the 1.3.x DEV branch allows any unauthenticated user to execute arbitrary command on the server

## How does it work?
On cacti versions `1.3.X dev` where `cmd_realtime.php` is present and `register_argc_argv` option is `ON` the command injection is possible thanks to manipulation of the `poller_id` parameter of an input in a `get` request

## Dork:
Google: `inurl:cmd_realtime.php`

Shodan: `Cacti`

File Snapshot


 [4.0K]  /data/pocs/d788ca20f1e22acbb20dafc4a1fe500c7fbc32cd
├── [3.3K]  poc.py
└── [ 667]  README.md

0 directories, 2 files

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →

Goal Reached Thanks to every supporter — we hit 100%!