Describe the behaviour you want to detect. SARA writes a starting Sigma rule with MITRE tags, false-positive guidance, and detection-engineering context. Anonymous, no account, best-effort generic detection.
title: CVE-2023-39364 Cacti Unauthenticated SQL Injection via pollers.php
id: 2fac2dac-10f8-4ccd-9325-dd5f08a6403f
status: experimental
description: |
Detects exploitation of CVE-2023-39364, a SQL injection vulnerability in
Cacti's pollers.php where the 'host' parameter is insufficiently sanitized
in get_filter_request_var(). Unauthenticated attackers can inject SQL
queries to extract credentials and pivot to RCE. CVSS 9.4 (Critical).
This rule covers HTTP-level exploit patterns visible in webserver/proxy
logs. Tune for your environment — legitimate Cacti poller administration
may trigger false positives.
references:
- https://github.com/Cacti/cacti/security/advisories/GHSA-6r3q-pm97-m2qj
- https://nvd.nist.gov/vuln/detail/CVE-2023-39364
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog
date: 2026-10-08
author: SARA Detection Engineering
tags:
- attack.initial_access
- attack.t1190
- attack.credential_access
- attack.t1552.001
logsource:
category: webserver
product: linux
detection:
selection_uri:
cs-uri-stem|contains|all:
- 'pollers.php'
cs-method: 'GET'
selection_sqli_patterns:
cs-uri-query|contains:
- 'host='
- 'host_id='
selection_injection:
cs-uri-query|contains:
- 'UNION'
- 'SELECT'
- 'SLEEP('
- 'BENCHMARK('
- 'extractvalue'
- 'updatexml'
- '0x'
- '/*'
- '--'
- 'OR 1=1'
- 'OR%201=1'
- 'AND 1=1'
- 'AND%201=1'
- 'INTO OUTFILE'
- 'INTO%20OUTFILE'
- 'LOAD_FILE'
- 'CHAR('
- 'CONCAT('
- 'GROUP_CONCAT'
- 'information_schema'
- 'mysql.user'
- 'cacti.user_auth'
filter_legitimate_poller:
cs-uri-query|re: 'host=\d{1,5}$'
cs-uri-query|contains:
- 'action='
condition: selection_uri and selection_sqli_patterns and selection_injection and not filter_legitimate_poller
fields:
- c-ip
- cs-method
- cs-uri-stem
- cs-uri-query
- cs-user-agent
- sc-status
- cs-host
falsepositives:
- Legitimate Cacti administrator performing poller maintenance with unusual query parameters
- Security scanners performing authorized vulnerability assessments
- Custom Cacti plugins that pass complex parameters through pollers.php
level: high
Sigma is the open, vendor-neutral format for log-based detections. One rule, written once, converts to Splunk SPL, Elastic ES|QL, KQL for Microsoft Sentinel, Sumo, Chronicle, QRadar, and more. Detection engineers love it for the same reason ATT&CK is the lingua franca for tactics — Sigma is the lingua franca for the queries that detect them.
You've got a fresh write-up of a TTP and need a starting detection in your stack today. Generate, tune, ship.
Pair-program with SARA: the generator produces the skeleton, the engineer learns by tuning, the team commits the result.
You have a rule in one query language; describe it in English and get the Sigma version + conversions to every other backend.
Sketch a detection idea in 30 seconds before investing in a full DE sprint.
SARA Open ships an OpenAI-compatible API. Call POST /api/v1/sigma — Plain English in, valid Sigma YAML out, with MITRE tags and false-positive guidance.
curl -X POST https://sara-open.sirp.io/api/v1/sigma \
-H "Authorization: Bearer $SARA_API_KEY" \
-H "Content-Type: application/json" \
-d '{"description": "PowerShell encoded command from Office"}'
Read the API reference →