Cacti Vulnerability Allows SQL Injection and Further Attacks

CVE-2024-31460

What is CVE-2024-31460?

Cacti, a popular operational monitoring and fault management framework, contains a SQL injection vulnerability in versions prior to 1.2.27. The vulnerability arises due to inadequate validation of data in the 'automation_tree_rules.php' file, which is utilized to construct SQL statements in the 'create_all_header_nodes()' function of 'lib/api_automation.php'. This weakness permits attackers to exploit SQL injection techniques, enabling them to manipulate database entries. By exploiting this flaw, attackers may gain the ability to read arbitrary files and could potentially execute remote code through unauthorized file writing operations. The issue has been addressed in version 1.2.27 with the release of an appropriate patch.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References