EUVD-2026-53372
GHSA-7v66-c77r-g454
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Network-accessible web endpoint, no complexity beyond a crafted GET parameter, any authenticated user suffices (PR:L), full database C/I/A impact confirmed by blind SQLi write capability.
AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Primary rating from Vendor (TuranSec).
CVSS VectorVendor: TuranSec
Lifecycle Timeline
2DescriptionCVE.org
Cacti's sanitize_sql_column() (lib/functions.php) sanitizes user-supplied ORDER BY column names using the regex preg_replace('/[^a-zA-Z0-9_().]/', '', $column). Because this allowlist retains letters, digits, underscore, parentheses, and dot (intended to support expressions like COUNT(id) and table.column), a payload such as SLEEP(5) passes through completely unmodified. The sanitized value is concatenated directly into raw SQL ORDER BY clauses (which cannot be parameterized) driven by a sort_column GET parameter in at least user_log.php, utilities.php, user_domains.php, and user_group_admin.php, allowing any authenticated Cacti user, regardless of privilege level, to perform time-based blind SQL injection against the Cacti database.
AnalysisAI
Time-based blind SQL injection in Cacti's ORDER BY handling allows any authenticated user - regardless of privilege level - to extract, modify, or destroy the Cacti database by supplying a crafted sort_column GET parameter to at least four administrative endpoints. The root cause is a regex-based sanitization allowlist in sanitize_sql_column() (lib/functions.php) that explicitly permits parentheses to support SQL expressions like COUNT(id), inadvertently passing payloads such as SLEEP(5) through unmodified before they are concatenated into unparameterized ORDER BY clauses. No public exploit code or KEV listing has been identified at time of analysis, but the low privilege bar and network accessibility make this a credible priority for any organization running Cacti.
Technical ContextAI
Cacti is a PHP-based network graphing and monitoring platform backed by an SQL database (typically MySQL/MariaDB). The vulnerable function sanitize_sql_column() in lib/functions.php applies the regex preg_replace('/[^a-zA-Z0-9_().]/', '', $column) to user-supplied column names. This allowlist was designed to support legitimate SQL expressions in ORDER BY clauses - such as COUNT(id) and table.column - but the inclusion of parentheses and alphanumerics means the MySQL time-delay function SLEEP(5) passes through entirely intact. ORDER BY clauses are a well-known parameterization dead zone in SQL: prepared statement placeholders cannot be used for column names or sort directions, forcing developers to rely on allowlisting. The allowlist here is semantically too broad. CWE-89 (Improper Neutralization of Special Elements used in an SQL Command) applies. Affected endpoints confirmed in the description are user_log.php, utilities.php, user_domains.php, and user_group_admin.php, each of which passes the sort_column GET parameter through this function. CPE cpe:2.3:a:cacti:cacti:*:*:*:*:*:*:*:* indicates all versions are affected with no upper bound confirmed.
RemediationAI
No vendor-released patched version has been independently confirmed at time of analysis - the provided references point only to the upstream repository (https://github.com/Cacti/cacti) and the vulnerable source file, not a tagged fix release. Monitor the Cacti GitHub repository for commits to lib/functions.php addressing sanitize_sql_column(). The correct fix is to replace the overly broad regex allowlist with a strict column whitelist validated against an explicit list of known-safe column names, or to wrap ORDER BY values in a lookup table that maps safe tokens to their SQL equivalents. As a compensating control, restrict access to the four affected endpoints (user_log.php, utilities.php, user_domains.php, user_group_admin.php) to trusted IP ranges or privileged user roles at the web server or application firewall layer; this trades administrative functionality for reduced attack surface. Additionally, enforce least-privilege database accounts for the Cacti application user so that blind injection cannot reach sensitive tables beyond Cacti's own schema. A WAF rule blocking SLEEP(, BENCHMARK(, and similar MySQL delay functions in GET parameters provides a shallow but low-cost additional layer. Do not rely on network-layer controls alone if Cacti is exposed to a broad internal user population.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Same weakness CWE-89 – SQL Injection
View allVendor StatusVendor
SUSE
Severity: ImportantShare
External POC / Exploit Code
Leaving vuln.today