Cacti Remote Command Execution Vulnerability in graph_view.php

A remote command execution vulnerability has been identified in Cacti versions prior to 0.8.6-d. The issue resides in the graph_view.php script, where authenticated users can inject arbitrary shell commands through the graph_start GET parameter. This injection is exploited during the graph rendering process, allowing commands to be executed on the underlying operating system with the privileges of the web server process.

Impact

Exploitation of this vulnerability allows for arbitrary command execution on the server, with the same privileges as the web server process.

Reproduction

To reproduce this vulnerability, an authenticated user must send a request to the graph_view.php script with the graph_start parameter containing the injected command. The vulnerability can be exploited by first obtaining a valid local_graph_id, which is required to trigger the command execution.