← back
CVE-2020-14295

CVE-2020-14295

60Vexday Risk Score

Patch soon. It has a working public exploit.

ssvc Attendepss 86%
from disclosure to weapon315 days
Published on NVDJun 17
1st PoC+315d
metasploitJun 17
exploitation probability
86%top 1% of all CVEs
observed exploitation
nono source reports it
5 public exploit(s)
A SQL injection issue in color.php in Cacti 1.2.12 allows an admin to inject SQL via the filter parameter. This can lead to remote command execution because the product accepts stacked queries.
Affected products
n/a · n/a
public PoCs found — 5
exploitdbwww.exploit-db.com/exploits/49810unverifiedgithubgithub.com/0z09e/CVE-2020-14295★ 2githubgithub.com/mrg3ntl3m4n/CVE-2020-14295★ 0cve_referencepacketstormsecurity.com/files/162384/Cacti-1.2.12-SQL-Injection-Remote-Code-Execution.htmlunverifiedcve_referencepacketstormsecurity.com/files/162918/Cacti-1.2.12-SQL-Injection-Remote-Command-Execution.htmlunverified
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
References
http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00067.htmlhttp://lists.opensuse.org/opensuse-security-announce/2020-07/msg00085.htmlhttp://packetstormsecurity.com/files/162384/Cacti-1.2.12-SQL-Injection-Remote-Code-Execution.htmlhttp://packetstormsecurity.com/files/162918/Cacti-1.2.12-SQL-Injection-Remote-Command-Execution.htmlhttps://github.com/Cacti/cacti/issues/3622https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/W64CIB6L4HZRVQSWKPDDKXJO4J2XTOXD/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZKM5G3YNSZDHDZMPCMAHG5B5M2V4XYSE/https://security.gentoo.org/glsa/202007-03