CVE-2013-5589

high

Published 2013-08-29 · Modified 2026-04-29

CVSS v3

—

CVSS v2

7.5

VIR risk

7.5

Description

SQL injection vulnerability in cacti/host.php in Cacti 0.8.8b and earlier allows remote attackers to execute arbitrary SQL commands via the id parameter.

Predictions

Exploit likelihood

20%

Patch ETA

—

Heuristic predictions, AS-IS, for prioritization only.

Mitigations

vendor Authored 2026-05-27

Vendor advisory: debian — https://security-tracker.debian.org/tracker/CVE-2013-5589

vendor Authored 2026-05-27

Vendor advisory: security@debian.org — http://bugs.cacti.net/view.php?id=2383

OS impact

OS	Version	Status	Fixed in
debian	bookworm	fixed	`0.8.8b+dfsg-3`
debian	bullseye	fixed	`0.8.8b+dfsg-3`
debian	forky	fixed	`0.8.8b+dfsg-3`
debian	sid	fixed	`0.8.8b+dfsg-3`
debian	trixie	fixed	`0.8.8b+dfsg-3`
suse	13.1	affected
suse	13.2	affected
debian	7.0	affected

Application impact

Vendor	Product	Versions
cacti	cacti	`{"endIncluding":"0.8.8b"}`
cacti	cacti	`0.8`
cacti	cacti	`0.8.1`
cacti	cacti	`0.8.2`
cacti	cacti	`0.8.2a`
cacti	cacti	`0.8.3`
cacti	cacti	`0.8.3a`
cacti	cacti	`0.8.4`
cacti	cacti	`0.8.5`
cacti	cacti	`0.8.5a`
cacti	cacti	`0.8.6`
cacti	cacti	`0.8.6a`
cacti	cacti	`0.8.6b`
cacti	cacti	`0.8.6c`
cacti	cacti	`0.8.6d`
cacti	cacti	`0.8.6e`
cacti	cacti	`0.8.6f`
cacti	cacti	`0.8.6g`
cacti	cacti	`0.8.6h`
cacti	cacti	`0.8.6i`
cacti	cacti	`0.8.6j`
cacti	cacti	`0.8.6k`
cacti	cacti	`0.8.7`
cacti	cacti	`0.8.7a`
cacti	cacti	`0.8.7b`
cacti	cacti	`0.8.7c`
cacti	cacti	`0.8.7d`
cacti	cacti	`0.8.7e`
cacti	cacti	`0.8.7f`
cacti	cacti	`0.8.7g`
cacti	cacti	`0.8.7h`
cacti	cacti	`0.8.7i`
cacti	cacti	`0.8.8`
cacti	cacti	`0.8.8a`

References

CWEs

CWE-89

Verify integrity in audit chain (admin only). AS-IS.