Wrongly implemented user input filters allows injection
of user input into executed commandline.
Alberto Trivero posted his Remote Command Execution
Exploit for Cacti <= 0.8.6d to Bugtraq on the 22th
June. Having analysed his bug we come to the conclusion,
that the malfunctioning input filters, which were already
mentioned in the previous advisory are also responsible
for this bug still being exploitable.
A HTTP headers bypass switch can also be used to
completely bypass the authentification system of Cacti. As
admin it is possible to execute shell commands with the
permission of the webserver.
While looking at the source of Cacti a HTTP headers
bypass switch was discovered, that also switches off a
call to session_start() and the manual
application of addslashes() in case of
magic_quotes_gpc=Off.
When register_globals is turned on* an attacker can use
this switch to disables Cacti's use of PHP's session
support and therefore supply the session variables on his
own through f.e. the URL. Additionally using the switch
renders several SQL statements vulnerable to SQL
Injections attacks, when magic_quotes_gpc is turned off,
which is the recommended setting.
Logged in as an admin it is possible to issue shell
commands.
(*) register_globals is turned off by default since PHP
4.2 but is activated on most servers because of older
scripts requiring it.