High severity · published Jun 17, 2020
CVE-2020-14295
A SQL injection issue in color.php in Cacti 1.2.12 allows an admin to inject SQL via the filter parameter
7.2
CVSS
86.1%
EPSS
No
On KEV
Description
A SQL injection issue in color.php in Cacti 1.2.12 allows an admin to inject SQL via the filter parameter. This can lead to remote command execution because the product accepts stacked queries.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
High
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)86.1% · higher than 100% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CA
Cacti · Cacti
1.2.12 · source: NVD
FE
Fedora · Fedoraproject
31; 32 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2020-14295
CVE.org
https://www.cve.org/CVERecord?id=CVE-2020-14295
Broken Link
http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00067.html
Broken Link
http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00085.html
Exploit
http://packetstormsecurity.com/files/162384/Cacti-1.2.12-SQL-Injection-Remote-Code-Execution.html
Exploit
http://packetstormsecurity.com/files/162918/Cacti-1.2.12-SQL-Injection-Remote-Command-Execution.html
Exploit
https://github.com/Cacti/cacti/issues/3622
lists.fedoraproject.org
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/W64CIB6L4HZRVQSWKPDDKXJO4J2XTOXD/
More from Cacti
9.8
CVE-2022-46169
Unauthenticated Command Injection
9.8
CVE-2026-40079
Cacti: Command Injection via escape_command() no-op in RRDtool execution
9.8
CVE-2026-39948
Cacti has SQL Injection via rfilter parameter in RLIKE clauses
9.8
CVE-2026-39955
Cacti has Pre-Authentication SQL Injection via unanchored FILTER_VALIDATE_REGEXP in graph_view.php
9.8
CVE-2026-39938
Cacti: Unauthenticated RCE on Graph Image