'; } else{ echo ''; } echo 'Hillstone Networks'; } elseif ($_SERVER[HTTP_HOST] == "update1.huaantech.com.cn") { echo ''; echo 'huaantech'; } elseif ($_SERVER[HTTP_HOST] == "update1.dcnetworks.com.cn") { echo ''; echo 'dcnetworks'; } elseif ($_SERVER[HTTP_HOST] == "update1.w-ibeda.com") { if (false===strpos($_SERVER[REQUEST_URI],"/en/")) echo ''; else echo ''; echo 'w-ibeda'; } elseif ($_SERVER[HTTP_HOST] == "update1.hp-telecom.com") { echo ''; echo 'hp-telecom'; } elseif ($_SERVER[HTTP_HOST] == "update1.maipu.com") { echo ''; echo 'Maipu'; } elseif ($_SERVER[HTTP_HOST] == "update1.ncurity.com") { echo ''; echo 'Ncurity'; } elseif ($_SERVER[HTTP_HOST] == "update1.socusnetwork.com") { echo ''; echo 'Socusnetwork'; } else{ echo ''; echo 'Hillstone Networks'; } ?>
 
   
 

vul_other:cacti_unauth_SQL_inject_vul（Rule ID：1070310181）

Release Date：2025/9/15

Rule Name：CVE-2023-39361: Cacti 1.2.24 Unauthenticated SQL Injection Vulnerability

Severity：critical

CVE ID：CVE-2023-39361

 

Descripiton：

Cacti is an open-source network traffic monitoring and analysis tool developed by the Cacti team. This tool obtains data through snmpget, uses RRDtool to draw graphics for analysis, and provides data and user management functions. Cacti version 1.2.24 has an SQL injection vulnerability, which is due to the fact that by default, guest users can access the graph_view.php without authentication. There is an SQL injection vulnerability in the parameter rfilter in the grow_right_pane_tree function called in the graph_view.php file. This rule supports to defend the A6: Vulnerable and Outdated Components of OWASP Top 10 - 2021.
Other reference：None

 

Solution：

Update vendor patches.