CVE-2024-54145: Cacti SQL Injection Vulnerability

CVE-2024-54145 Overview

Cacti is an open source performance and fault management framework used for network monitoring and graphing. A SQL injection vulnerability [CWE-89] exists in the get_discovery_results function of automation_devices.php. The flaw stems from insufficient sanitization of the network parameter before it reaches database queries. An authenticated attacker with low privileges can inject arbitrary SQL statements over the network. The vulnerability is fixed in version 1.2.29.

Critical Impact
An authenticated attacker can execute arbitrary SQL queries against the Cacti backend database, potentially leading to full compromise of confidentiality, integrity, and availability.

Affected Products

Cacti versions prior to 1.2.29
Debian LTS distributions shipping vulnerable Cacti packages
Self-hosted Cacti network monitoring deployments

Discovery Timeline

2025-01-27 - CVE-2024-54145 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-54145

Vulnerability Analysis

The vulnerability resides in the get_discovery_results function within automation_devices.php. This function processes automation device discovery results and accepts a network parameter supplied by the requesting user. The parameter value flows into a SQL query without adequate parameterization or type enforcement, allowing an authenticated attacker to break out of the intended query context.

A successful attack yields arbitrary read and write access to the Cacti database. Because Cacti stores monitoring configuration, user credentials, and device metadata, an attacker can pivot from database access to broader network reconnaissance and administrative account takeover.

Root Cause

The root cause is improper neutralization of special characters in the network request parameter used within the automation devices workflow. The affected code path did not enforce strict input filtering (for example, FILTER_VALIDATE_INT or callback sanitizers) before assembling the SQL query, allowing injection through the parameter.

Attack Vector

Exploitation requires network access to the Cacti web interface and a valid authenticated session with low privileges. The attacker issues a crafted HTTP request to the automation devices endpoint with a malicious network parameter. No user interaction is required beyond attacker-controlled request submission.

php

// Patched input filter definitions in automation_devices.php
// Source: https://github.com/Cacti/cacti/commit/c7e4ee798d263a3209ae6e7ba182c7b65284d8f0
'page' => array(
    'filter'  => FILTER_VALIDATE_INT,
    'default' => '1'
),
'filter' => array(
    'filter'  => FILTER_DEFAULT,
    'pageset' => true,
    'default' => ''
),
'sort_column' => array(
    'filter'  => FILTER_CALLBACK,
    'default' => 'hostname',
    'options' => array('options' => 'sanitize_search_string')
),
'sort_direction' => array(
    'filter'  => FILTER_CALLBACK,
    'default' => 'ASC',
    'options' => array('options' => 'sanitize_search_string')
),

Detection Methods for CVE-2024-54145

Indicators of Compromise

HTTP requests to automation_devices.php containing SQL metacharacters (single quotes, UNION, SELECT, --) in the network parameter.
Unexpected authenticated sessions issuing repeated requests to the automation devices endpoint from a single source.
Database error entries in Cacti or PHP logs referencing get_discovery_results or malformed SQL statements.

Detection Strategies

Inspect web server access logs for anomalous query strings targeting automation_devices.php with the network parameter.
Enable database query auditing to identify unexpected UNION, INFORMATION_SCHEMA, or SLEEP() statements originating from the Cacti application user.
Deploy WAF signatures for common SQL injection payloads targeting Cacti endpoints.

Monitoring Recommendations

Monitor for privilege changes and new user creation events within the Cacti user_auth table.
Alert on outbound network activity from the Cacti host that deviates from expected polling behavior.
Track authentication anomalies such as brute-force attempts or session reuse against the Cacti web console.

How to Mitigate CVE-2024-54145

Immediate Actions Required

Upgrade Cacti to version 1.2.29 or later, which contains the fix committed in Cacti commit c7e4ee7.
Rotate all Cacti user credentials and database credentials if exploitation is suspected.
Restrict access to the Cacti web interface to trusted management networks only.

Patch Information

The vendor fix is available in Cacti 1.2.29 and referenced in the GitHub Security Advisory GHSA-fh3x-69rr-qqpp. Debian users should apply the update described in the Debian LTS Announcement.

Workarounds

Remove or restrict access to the automation devices feature if upgrading is not immediately possible.
Enforce least-privilege database credentials for the Cacti application user to limit injection impact.
Place the Cacti console behind a reverse proxy with SQL injection filtering rules enabled.

bash

# Verify installed Cacti version and upgrade
dpkg -l | grep cacti
apt-get update && apt-get install --only-upgrade cacti

# Restrict web access to management network via web server config
# Example nginx snippet:
# location /cacti/ { allow 10.0.0.0/24; deny all; }