CVE-2024-31460

What it actually does

Unsanitized input from automation_tree_rules.php is concatenated into an SQL statement inside create_all_header_nodes() in lib/api_automation.php, enabling SQL injection that can alter database contents and lead to arbitrary file read/write and remote code execution.

Why it matters to the business

Attackers can tamper with monitoring configuration and data, potentially leading to unauthorized system access, data exfiltration, or full server compromise that disrupts operational visibility and incident response.

How an attack unfolds

An authenticated attacker supplies crafted values that reach the vulnerable SQL concatenation; secondary injection modifies Cacti database entries; the attacker then leverages the altered data to read or write files on the server and ultimately achieve remote code execution.

How to fix it

Upgrade Cacti to version 1.2.27 or apply the patch at commit b577c294214b7e65a7273031ef8f0045d2a0c5af; restrict access to automation configuration endpoints and review database permissions for the Cacti service account.

How to confirm the fix worked

Confirm the installed version is 1.2.27 or later, review the patched api_automation.php file for the commit, and test that automation tree rule inputs no longer produce unexpected SQL behavior.

Typical attack path

1. Identify reachable Cacti instance and obtain low-privileged credentials
2. Submit malicious input through automation tree rule interfaces
3. Trigger SQL injection via create_all_header_nodes path to modify database records
4. Use modified records to perform file operations or write malicious content
5. Execute arbitrary code on the underlying host

How to detect it

Search web-server and application logs for unusual requests to automation_tree_rules.php or api_automation.php containing SQL metacharacters; inspect database audit logs for unexpected inserts or updates to automation tree rules; look for new or modified files written by the Cacti process after suspicious activity.

What your security team should do

• Immediately upgrade all Cacti instances to the fixed version
• Audit and restrict network access to Cacti web interfaces
• Monitor database for unexpected changes in automation-related tables
• Review logs for anomalous SQL or file-write activity post-upgrade