CVE-2023-39358

Name	CVE-2023-39358
Description	Cacti is an open source operational monitoring and fault management framework. An authenticated SQL injection vulnerability was discovered which allows authenticated users to perform privilege escalation and remote code execution. The vulnerability resides in the `reports_user.php` file. In `ajax_get_branches`, the `tree_id` parameter is passed to the `reports_get_branch_select` function without any validation. This issue has been addressed in version 1.2.25. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
cacti (PTS)	buster	1.2.2+ds1-2+deb10u4	vulnerable
	buster (security)	1.2.2+ds1-2+deb10u5	vulnerable
	bullseye (security), bullseye	1.2.16+ds1-2+deb11u1	vulnerable
	bookworm	1.2.24+ds1-1	vulnerable
	trixie, sid	1.2.25+ds1-2	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
cacti	source	(unstable)	1.2.25+ds1-1

https://github.com/Cacti/cacti/security/advisories/GHSA-gj95-7xr8-9p7g