CVE-2024-54146

Cacti, an open-source network performance and fault monitoring framework, contains a SQL injection flaw (CWE-89) in the template function of host_templates.php. The graph_template parameter is insufficiently sanitized before being used in SQL queries, so an attacker with low-privileged (authenticated) access to the Cacti web interface can send crafted parameter values to inject arbitrary SQL. Successful exploitation yields high-impact read, write, and potential disruption against the Cacti backend database (CVSS 8.8, AV:N/AC:L/PR:L/UI:N), potentially exposing stored monitoring data and credentials for further compromise. All Cacti deployments running a version prior to 1.2.29 are affected. A public security advisory with proof-of-concept details exists, EPSS places exploitation probability at 41% within 30 days (99th percentile), but the flaw is not yet in CISA's KEV catalog and no widespread confirmed exploitation is documented.

What to do: Upgrade Cacti to version 1.2.29 or later, which remediates the flaw. Until patched, restrict network access to the Cacti web UI to trusted users and networks, and review web access logs for anomalous or malformed graph_template values submitted to host_templates.php. Note the vulnerability requires authenticated access, so audit for low-privilege or default accounts that could be used to trigger it.