SQL Injection Vulnerability in Cacti Performance Management Framework
CVE-2024-54145

8.8HIGH

Key Information:

Vendor

Cacti

Status
Cacti
Vendor
CVE Published:
27 January 2025

What is CVE-2024-54145?

Cacti, an open-source performance and fault management framework, has been found to have a significant SQL injection vulnerability within its get_discovery_results function located in automation_devices.php. This vulnerability exploits the network parameter, potentially allowing unauthorized users to execute malicious SQL queries. Users are strongly encouraged to upgrade to Cacti version 1.2.29 or later to mitigate this security risk. For further details and updates, please refer to the provided advisory links.

Affected Version(s)

cacti < 1.2.29

References

https://github.com/Cacti/cacti/security/advisories/GHSA-f...
x_refsource_CONFIRM
https://github.com/Cacti/cacti/commit/c7e4ee798d263a3209a...
x_refsource_MISC

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.
CVE-2024-54145 : SQL Injection Vulnerability in Cacti Performance Management Framework