CVE-2004-1737
SQL injection vulnerability in auth_login.php in Cacti 0.8.5a allows remote attackers to execute...
CVE-2004-1737 is a high vulnerability (CVSS 7.5) in The Cacti Group Cacti, published August 16, 2004. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 2.83%, the 86th percentile. Fixed in cacti 0.8.5a-5.
- Severity
- 7.5 HighCVSS 2.0, NVD
- Exploit chance
- 2.83%EPSS, 86th percentile
- Exploitation
- None known1 public exploit
- Fixed in
0.8.5a-5cacti +2 more
Description
SQL injection vulnerability in auth_login.php in Cacti 0.8.5a allows remote attackers to execute arbitrary SQL commands and bypass authentication via the (1) username or (2) password parameters.
Exploit likelihood
Affected products
Affected packages
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Exploit-DB | RaXnet Cacti 0.6.x/0.8.x - 'Auth_Login.php' SQL Injection | 2004-07-16 |
What each source reports
NVD Score used
SQL injection vulnerability in auth_login.php in Cacti 0.8.5a allows remote attackers to execute arbitrary SQL commands and bypass authentication via the (1) username or (2) password parameters.
- Record
CVE-2004-1737- CVSS 2.0
- 7.5 High
AV:N/AC:L/Au:N/C:P/I:P/A:P - Updated
- 2026-11-02
CVE ListNo score
SQL injection vulnerability in auth_login.php in Cacti 0.8.5a allows remote attackers to execute arbitrary SQL commands and bypass authentication via the (1) username or (2) password parameters.
- Record
CVE-2004-1737- Updated
- 2026-11-02
EUVDEUVD-2004-1731No score
SQL injection vulnerability in auth_login.php in Cacti 0.8.5a allows remote attackers to execute arbitrary SQL commands and bypass authentication via the (1) username or (2) password parameters.
- Record
EUVD-2004-1731- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-v3h5-fhg8-jp65No score
SQL injection vulnerability in auth_login.php in Cacti 0.8.5a allows remote attackers to execute...
SQL injection vulnerability in auth_login.php in Cacti 0.8.5a allows remote attackers to execute arbitrary SQL commands and bypass authentication via the (1) username or (2) password parameters.
- Record
GHSA-v3h5-fhg8-jp65- Updated
- 2026-11-02
OSVNo score
SQL injection vulnerability in auth_login.php in Cacti 0.8.5a allows remote attackers to execute arbitrary SQL commands and bypass authentication via the (1) username or (2) password parameters.
- Record
CVE-2004-1737- Updated
- 2026-11-02
OSVDEBIAN-CVE-2004-1737No score
SQL injection vulnerability in auth_login.php in Cacti 0.8.5a allows remote attackers to execute arbitrary SQL commands and bypass authentication via the (1) username or (2) password parameters.
- Record
DEBIAN-CVE-2004-1737- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| facts | ||
| aliases | EUVD | |
| first indexed | CVE List, Exploit-DB, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
References
lists.grok.org.uk/pipermail/full-disclosure/2004-August/025376.html
exchange.xforce.ibmcloud.com/vulnerabilities/17011
securityfocus.com/bid/10960
secunia.com/advisories/12308
marc.info?l=bugtraq&m=109272483621038&w=2
gentoo.org/security/en/glsa/glsa-200408-21.xml
nvd.nist.gov/vuln/detail/CVE-2004-1737
github.com/advisories/GHSA-v3h5-fhg8-jp65
security-tracker.debian.org/tracker/CVE-2004-1737