CVE-2004-1737

Severity: high (CVSS 7.5 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.8% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2004-08-16 · updated 2026-06-16

Description

SQL injection vulnerability in auth_login.php in Cacti 0.8.5a allows remote attackers to execute arbitrary SQL commands and bypass authentication via the (1) username or (2) password parameters.

Affected products

gentoo Linux: 1.4
The Cacti Group Cacti: 0.6, 0.6.1, 0.6.2, 0.6.3, 0.6.4, 0.6.5 (+13)

References

http://lists.grok.org.uk/pipermail/full-disclosure/2004-August/025376.html
http://marc.info/?l=bugtraq&m=109272483621038&w=2
http://secunia.com/advisories/12308
http://www.gentoo.org/security/en/glsa/glsa-200408-21.xml
http://www.securityfocus.com/bid/10960
https://exchange.xforce.ibmcloud.com/vulnerabilities/17011
http://lists.grok.org.uk/pipermail/full-disclosure/2004-August/025376.html
http://marc.info/?l=bugtraq&m=109272483621038&w=2
http://secunia.com/advisories/12308
http://www.gentoo.org/security/en/glsa/glsa-200408-21.xml
http://www.securityfocus.com/bid/10960
https://exchange.xforce.ibmcloud.com/vulnerabilities/17011

Get alerted when CVE-2004-1737 or the next vulnerability affects your stack