Log Poisoning: An attacker injects PHP code into device names, which gets logged by Cacti without proper sanitization.
Execution: By accessing the logs via a web URL, the injected code is executed, allowing the attacker to run commands on the server.

Check Version: The script checks if the target Cacti version is vulnerable.
Create Malicious Device: It attempts to create a device with a PHP code-injected name.
Check Logs: The script checks if the code appears in the logs and could be executed.

Python 3.x
requests library: Install with pip install requests

Clone the repository and navigate to the folder.
Edit the url and token variables in the script to match your target.
Run the script:

bash