Authenticated SQL injection vulnerability in graphs.php in Cacti
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- SQL injection
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-89.
Summary
Cacti is an open source operational monitoring and fault management framework. An authenticated SQL injection vulnerability was discovered which allows authenticated users to perform privilege escalation and remote code execution. The vulnerability resides in the `graphs.php` file. When dealing with the cases of ajax_hosts and ajax_hosts_noany, if the `site_id` parameter is greater than 0, it is directly reflected in the WHERE clause of the SQL statement. This creates an SQL injection vulnerability. This issue has been addressed in version 1.2.25. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Cacti | cacti | before 1.2.25 | 1.2.25 | Patch available | CNA |
- cacti VendorCacti Affected before 1.2.25 Fixed in 1.2.25 Patch available CNA
CPE configurations NVD · 3
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:cacti:cacti:*:*:*:*:*:*:*:* | before 1.2.25 | Vulnerable | Cacti |
| cpe:2.3:o:fedoraproject:fedora:37:*:*:*:*:*:*:* | 37 | Vulnerable | Fedoraproject |
| cpe:2.3:o:fedoraproject:fedora:38:*:*:*:*:*:*:* | 38 | Vulnerable | Fedoraproject |
- cpe:2.3:a:cacti:cacti:*:*:*:*:*:*:*:* Versions before 1.2.25 Vulnerable ·Cacti
- cpe:2.3:o:fedoraproject:fedora:37:*:*:*:*:*:*:* Versions 37 Vulnerable ·Fedoraproject
- cpe:2.3:o:fedoraproject:fedora:38:*:*:*:*:*:*:* Versions 38 Vulnerable ·Fedoraproject
Remediation
- Fix · CNA cacti (Cacti) Fixed in 1.2.25
Vendor assessments
Timeline
- 2026-10-02 Threatist record created from CVE-2023-39359
References
Other 4
- https://lists.fedoraproject.org/archives/list/[email protected]/message/WZGB2UXJEUYWWA6IWVFQ3ZTP22FIHMGN/
- https://lists.fedoraproject.org/archives/list/[email protected]/message/CFH3J2WVBKY4ZJNMARVOWJQK6PSLPHFH/
- https://lists.fedoraproject.org/archives/list/[email protected]/message/WOQFYGLZBAWT4AWNMO7DU73QXWPXTCKH/
- https://www.debian.org/security/2023/dsa-5550
More Cacti vulnerabilities
- TI-2022-22813 Unauthenticated command injection in cacti KEVCVSS 3.1CRITICAL 9.8
- TI-2023-20500 Unauthenticated SQL Injection in graph_view.php in Cacti CVSS 3.1CRITICAL 9.8
- TI-2024-16869 Cacti RCE vulnerability when importing packages CVSS 3.1CRITICAL 9.1
- TI-2024-20809 SQL Injection vulnerability in automation_get_new_graphs_sql CVSS 3.1HIGH 8.8
- TI-2023-26750 Cacti SQL Injection vulnerability CVSS 3.1HIGH 8.8
- TI-2025-18110 Cacti allows Arbitrary File Creation leading to RCE CVSS 4.0HIGH 8.7
Sources
- CVE-2023-39359 · CVE Program
- CVE-2023-39359 · NVD
- FIRST EPSS
- CVE-2023-39359 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences