CVE-2020-14295: 
Cacti vulnerability analysis and mitigation

A SQL injection vulnerability was discovered in Cacti version 1.2.12, specifically in the color.php file. The vulnerability allows an authenticated administrator to inject SQL via the filter parameter. This vulnerability was assigned CVE-2020-14295 and was disclosed on June 17, 2020. The issue affects the color.php page functionality in Cacti 1.2.12 and earlier versions (NVD, Debian).

The vulnerability exists due to improper input validation in the color.php file. The issue occurs when handling the 'filter' parameter, where user input is directly concatenated into SQL queries without proper sanitization. The vulnerability has a CVSS v3.1 Base Score of 7.2 (High), with the vector string CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H. The attack requires high privileges (administrator access) but no user interaction (AttackerKB).

The vulnerability can lead to remote command execution because the product accepts stacked queries. An attacker can potentially modify database settings, including the path_php_binary setting, which can be leveraged to execute arbitrary commands on the system. This allows for complete system compromise within the context of the web application's privileges (Github).

The vulnerability requires administrator authentication to exploit. A proof-of-concept exploit involves sending a crafted request to color.php with a malicious filter parameter that includes SQL injection payload. The exploit can be triggered by calling host.php?action=reindex after modifying the path_php_binary setting in the database (Github).

The vulnerability was fixed in Cacti version 1.2.13. The fix involves proper input validation and sanitization of the filter parameter using db_qstr() function instead of direct string concatenation. Users are advised to upgrade to Cacti version 1.2.13 or later (Gentoo, Fedora).