Authenticated SQL injection vulnerability in graphs.php in Cacti

CVE-2023-39359

What is CVE-2023-39359?

An authenticated SQL injection vulnerability has been identified in Cacti's operational monitoring framework. This issue affects the graphs.php file where improper handling of the site_id parameter could allow authenticated users to manipulate SQL queries, leading to potential privilege escalation and remote code execution. It is critical for users to upgrade to version 1.2.25 or later as there are no known workarounds available to mitigate this vulnerability.

References