CVE-2024-31458

What it actually does

Unsanitized input from form_save() in graph_template_inputs.php is concatenated into a SQL statement inside draw_nontemplated_fields_graph_item() in lib/html_form_templates.php, enabling an authenticated attacker to alter the generated query and modify database contents.

Why it matters to the business

Attackers can tamper with monitoring configuration data, leading to incorrect graphs, faulty alerting, and potential loss of operational visibility for organizations running Cacti.

How an attack unfolds

An attacker authenticates with limited privileges, crafts a malicious request containing SQL syntax in the form fields handled by form_save(), and triggers the draw_nontemplated_fields_graph_item() path that builds and executes the unsanitized query, resulting in unauthorized data changes.

How to fix it

Upgrade Cacti to version 1.2.27 or apply commit b577c294214b7e65a7273031ef8f0045d2a0c5af; restrict web application database accounts to least privilege; consider web application firewall rules that block suspicious SQL metacharacters in form parameters.

How to confirm the fix worked

Confirm the installed version is 1.2.27 or later; review the patched code in graph_template_inputs.php and html_form_templates.php to verify input sanitization is present; test the affected endpoints with known-bad input patterns in a non-production environment.

Typical attack path

1. Obtain a low-privileged authenticated session
2. Submit crafted POST data to the graph template inputs save endpoint
3. Trigger rendering of nontemplated graph item fields to execute the injected SQL
4. Observe or leverage resulting database modifications

How to detect it

Inspect web server and application logs for unexpected SQL syntax or errors originating from graph_template_inputs.php and html_form_templates.php; correlate with authentication events for the same session; search database audit logs for unauthorized modifications to graph-related tables.

What your security team should do

• Apply the fixed commit or upgrade to 1.2.27 within the next maintenance window
• Audit database permissions for the Cacti application account
• Enable query logging and monitor for anomalous SQL statements from the web application
• Review recent changes to graph templates for signs of tampering