Cacti remote_agent.php Remote Command Execution Vulnerability CVE-2022-46169

Vulnerability Description

Cacti is a server monitoring and management platform. A command injection vulnerability exists in versions 1.2.17 to 1.2.22. An attacker can bypass server-side validation via the X-Forwarded-For request header and execute arbitrary commands.

Affected Versions

Cacti < 1.2.17-1.2.22

Network Detection

app="Cacti-监控系统"

Exploit Reproduction