Cacti Vulnerability Allows SQL Injection and Further Attacks

CVE-2024-31460

What is CVE-2024-31460?

Cacti, a popular operational monitoring and fault management framework, contains a SQL injection vulnerability in versions prior to 1.2.27. The vulnerability arises due to inadequate validation of data in the 'automation_tree_rules.php' file, which is utilized to construct SQL statements in the 'create_all_header_nodes()' function of 'lib/api_automation.php'. This weakness permits attackers to exploit SQL injection techniques, enabling them to manipulate database entries. By exploiting this flaw, attackers may gain the ability to read arbitrary files and could potentially execute remote code through unauthorized file writing operations. The issue has been addressed in version 1.2.27 with the release of an appropriate patch.

References