CVE-2023-49084: 
Cacti vulnerability analysis and mitigation

CVE-2023-49084 affects Cacti, a robust performance and fault management framework and frontend to RRDTool. The vulnerability was discovered and disclosed on December 21, 2023. The vulnerability allows for arbitrary code execution on the server through SQL Injection and insufficient processing of the include file path. The vulnerable component is specifically identified as link.php, and exploitation requires an authorized user (NVD, GitHub Advisory).

The vulnerability combines SQL Injection with insufficient processing of include file paths. The attack vector involves writing malicious data to the external_links table via SQL Injection and exploiting insufficient directory traversal prevention in link.php. The CVSS v3.1 base score is 8.8 (High) with vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, indicating network accessibility, low attack complexity, and high impact on confidentiality, integrity, and availability (NVD).

When successfully exploited, the vulnerability allows for arbitrary code execution on the server. This means an attacker could potentially execute system commands, access sensitive data, modify system files, or gain broader access to the server hosting the Cacti installation (GitHub Advisory).

The vulnerability requires an authorized user account for exploitation. The attack involves a multi-step process: first using SQL Injection to write specific data to the external_links table, then bypassing directory traversal prevention, and finally executing arbitrary code through log file poisoning. A proof-of-concept exploit has been documented (GitHub Advisory).

The vulnerability has been patched in Cacti version 1.2.26. Organizations running affected versions should upgrade to the patched version immediately. Multiple Linux distributions have also released security updates to address this vulnerability, including Debian and Fedora (Debian Advisory, Fedora Update).