CVE-2005-10004
Cacti graph_view.php RCE via graph_start Parameter Injection
- State
- Published
- Severity
- 8.7 High
- Published
- Aug 30, 2025
- Updated
- Jul 28, 2026
- Reserved
- Aug 28, 2025
Description
Cacti versions prior to 0.8.6-d contain a remote command execution vulnerability in the graph_view.php script. An authenticated user can inject arbitrary shell commands via the graph_start GET parameter, which is improperly handled during graph rendering. This flaw allows attackers to execute commands on the underlying operating system with the privileges of the web server process, potentially compromising system integrity.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 8.7 High | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N | VulnCheck |
Weaknesses
- CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Affected Products
| Product | Versions |
|---|---|
CactiRaxnet/Ian Berry |
|
References
- https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/unix/webapp/cacti_graphimage_exec.rbexploit
- https://www.exploit-db.com/exploits/9911exploit
- https://www.exploit-db.com/exploits/16881exploit
- https://www.cacti.net/info/downloadsproduct
- https://web.archive.org/web/20050305034552/http://www.cacti.net/cactid_download.phpproductpatch
- https://www.vulncheck.com/advisories/cacti-graph-view-rcethird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.