Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
8.8
CVE-2024-31460: Cacti can let attackers alter its database
CVE-2024-31460 · published 2 years ago
Summary
Versions of Cacti before 1.2.27 do not properly check data used to build database queries, allowing a malicious user to inject their own commands. This can let an attacker change the contents of the Cacti database and potentially read files or run code on the server. Upgrade to Cacti 1.2.27 or later to apply the fix.
What to do
- Update debian cacti to version 1.2.24+ds1-1+deb12u3.
- Update debian cacti to version 1.2.27+ds1-1.
- Update cacti cacti to version 1.2.27 or later.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Debian:12 | debian | cacti |
< 1.2.24+ds1-1+deb12u3 Fix: upgrade to 1.2.24+ds1-1+deb12u3
|
| Debian:13 | debian | cacti |
< 1.2.27+ds1-1 Fix: upgrade to 1.2.27+ds1-1
|
| Debian:14 | debian | cacti |
< 1.2.27+ds1-1 Fix: upgrade to 1.2.27+ds1-1
|
| – | cacti | cacti |
< 1.2.27 cpe:2.3:a:cacti:cacti:*:*:*:*:*:*:*:* |
| – | fedoraproject | fedora |
39 cpe:2.3:o:fedoraproject:fedora:39:*:*:*:*:*:*:* |
Original advisory text
Cacti SQL Injection vulnerability in lib/api_automation.php caused by reading dirty data stored in database
Cacti provides an operational monitoring and fault management framework. Prior to version 1.2.27, some of the data stored in `automation_tree_rules.php` is not thoroughly checked and is used to concatenate the SQL statement in `create_all_header_nodes()` function from `lib/api_automation.php` , finally resulting in SQL injection. Using SQL based secondary injection technology, attackers can modify the contents of the Cacti database, and based on the modified content, it may be possible to achieve further impact, such as arbitrary file reading, and even remote code execution through arbitrary file writing. Version 1.2.27 contains a patch for the issue.
References
- https://security-tracker.debian.org/tracker/CVE-2024-31460 Vendor Advisory
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/31xxx/CVE-2024-31460... Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2024-31460 Vendor Advisory
- https://lists.debian.org/debian-lts-announce/2024/09/msg00027.html URL
- https://lists.fedoraproject.org/archives/list/[email protected]... URL
- https://github.com/Cacti/cacti/security/advisories/GHSA-cx8g-hvq8-p2rv Vendor Advisory
- https://github.com/Cacti/cacti/security/advisories/GHSA-gj3f-p326-gh8r Vendor Advisory
Internet-facing
14 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker full control
Type
CWE-89SQL Injection
Timeline
Published14 May 2024
Updated3 Nov 2026
First seen1 Sep 2026
Track software like this
Free during beta