CVE-2024-31445CWE-89

SQL Injection vulnerability in automation_get_new_graphs_sql

High · published May 13, 2024

CVSS v3.1
8.8
EPSS
26%
Percentile
98.0
In the wild
Unconfirmed
What it is

Cacti provides an operational monitoring and fault management framework. Prior to version 1.2.27, a SQL injection vulnerability in `automation_get_new_graphs_sql` function of `api_automation.php` allows authenticated users to exploit these SQL injection vulnerabilities to perform privilege escalation and remote code execution. In `api_automation.php` line 856, the `get_request_var('filter')` is being concatenated into the SQL statement without any sanitization. In `api_automation.php` line 717, The filter of `'filter'` is `FILTER_DEFAULT`, which means there is no filter for it. Version 1.2.27 contains a patch for the issue.

The record
Technical detail
CVSS v3.1
8.8 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.26154 · 98.0th percentile
Weakness
CWE-89 · Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Published
2024-05-13T15:05Z
EPSS history
Timeline
  • 13 MAY 15:05Z
    SQL Injection vulnerability in automation_get_new_graphs_sql
    cvelistv5