Fernando Quintero has reported two vulnerabilities in Cacti, which can be exploited by malicious people to see the installation path and conduct SQL injection attacks.

1) Path information can be disclosed in error pages by passing invalid input or accessing scripts directly.

Examples:
http://[victim]/cacti/include/auth.php
http://[victim]/cacti/auth_login.php?action=login
http://[victim]/cacti/auth_changepassword.php?ref=indexphp&action=changepassword&password=aaaaaa&confirm=aaaaaa&submit=Save

2) Input passed to the "username" and "password" parameters in "auth_login.php" isn't properly verified before being used in SQL queries. This can be exploited to manipulate SQL queries by injecting arbitrary SQL code in order to change the administrator's password and login without supplying a password.

Successful exploitation requires that "magic_quotes_gpc" is disabled.

The vulnerabilities have been reported in version 0.8.5 and prior.

Solution
Set "magic_quotes_gpc" to "on".
Further details available in Customer Area

Provided and/or discovered by
Fernando Quintero

Changelog
Further details available in Customer Area

Deep Links
Links available in Customer Area