SQL Injection Vulnerability in Cacti

The BSI has reported a critical vulnerability in Cacti, a popular network monitoring and graphing tool. The flaw allows a remote, authenticated attacker to execute arbitrary SQL commands through improper input validation within the application. This vulnerability is tracked as CVE-2024-25641. Affected versions include all releases prior to 1.2.27. By successfully injecting malicious SQL queries, an attacker could manipulate database contents, bypass authentication mechanisms, or extract sensitive monitoring data stored within the backend database. This impact is significant for organizations relying on Cacti for network visibility, as it exposes the monitoring infrastructure to administrative compromise.

Impact

Successful exploitation of this vulnerability enables an attacker to gain unauthorized access to the Cacti database. Given that Cacti often holds credentials for network devices and sensitive configuration data for managed infrastructure, a breach could lead to lateral movement or the compromise of the wider monitored network environment.

Recommendation

• Immediately upgrade all Cacti installations to version 1.2.27 or later to patch CVE-2024-25641.
• Audit web server logs for suspicious SQL syntax in requests originating from authenticated users.
• Enforce strict access control for the Cacti administrative interface to minimize the risk of malicious authenticated users.