Cacti Patches SQL Injection Vulnerability in Version 1.2.27

CVE-2024-31458

What is CVE-2024-31458?

The Cacti Monitoring Framework has a vulnerability stemming from insufficient validation of input data in the form_save() function within the graph_template_inputs.php file. This oversight occurs prior to version 1.2.27, allowing crafted input to manipulate SQL queries in the draw_nontemplated_fields_graph_item() function found in lib/html_form_templates.php. As a result, attackers can potentially exploit this flaw to execute unauthorized SQL commands, compromising the integrity of the database. It is crucial for users of affected versions to upgrade to version 1.2.27 or later, which addresses this security issue, to ensure protection against such SQL injection attacks. For detailed information, refer to the advisory on GitHub.

References