CVE-2024-54146: Cacti SQL Injection Vulnerability

CVE-2024-54146 Overview

Cacti is an open-source performance and fault management framework used to collect and visualize network monitoring data. CVE-2024-54146 is a SQL injection vulnerability [CWE-89] in the template function of host_templates.php. The flaw stems from improper sanitization of the graph_template parameter. An authenticated attacker with low privileges can inject arbitrary SQL statements through this parameter over the network. Successful exploitation compromises confidentiality, integrity, and availability of the Cacti database. The vulnerability is fixed in version 1.2.29.

Critical Impact
Authenticated attackers can execute arbitrary SQL queries against the Cacti backend database, enabling data theft, tampering, and potential downstream compromise of monitored infrastructure. The EPSS score of 40.996% (98.528 percentile) indicates elevated exploitation probability.

Affected Products

Cacti versions prior to 1.2.29
Component: cacti:cacti
Affected file: host_templates.php

Discovery Timeline

2025-01-27 - CVE-2024-54146 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-54146

Vulnerability Analysis

The vulnerability resides in the host template management function inside host_templates.php. Cacti passes the graph_template request parameter into a SQL query without adequate parameterization or type enforcement. Because the parameter is treated as trusted input, an attacker can append arbitrary SQL clauses to the underlying statement. The result is direct query manipulation against the Cacti MySQL database. This gives attackers read and write access to configuration data, credentials, and device inventory records used by Cacti to poll monitored hosts.

Root Cause

The root cause is missing input validation and lack of prepared statements around the graph_template parameter. Cacti historically relied on server-side filters registered through arrays similar to FILTER_VALIDATE_INT for other endpoints. That protection was not applied consistently in the host template code path. The fix in 1.2.29 adds proper input filtering and query sanitization, aligning this endpoint with the validation pattern used elsewhere in the codebase.

Attack Vector

Exploitation requires network access to the Cacti web interface and valid low-privileged credentials. The attacker sends a crafted request to the host templates endpoint with a malicious payload in the graph_template parameter. The injected SQL executes with the privileges of the Cacti database user. No user interaction is required beyond the attacker's own authenticated session.

text

// Cacti CHANGELOG entry documenting the fix in 1.2.29
1.2.29
-security#GHSA-vj9g-P7F2-4wqj: SQL Injection vulnerability when view host template
-security#GHSA-f9c7-7rc3-574c: SQL Injection vulnerability when using tree rules through Automation API
-security#GHSA-fh3x-69rr-qqpp: SQL Injection vulnerability when request automation devices
-security#GHSA-pv2c-97pp-vxwg: Local File Inclusion (LFI) via Poller Standard Error Log Path
-security#GHSA-c5j8-jxj3-hh36: Authenticated RCE via multi-line SNMP responses
-security#GHSA-fxrq-fr7h-9rqq: Arbitrary File Creation leading to RCE

Source: GitHub Cacti Commit c7e4ee7

Detection Methods for CVE-2024-54146

Indicators of Compromise

Unexpected HTTP POST or GET requests to host_templates.php containing SQL metacharacters such as ', --, UNION, or SLEEP( in the graph_template parameter.
Cacti web server access logs showing repeated requests to the host templates endpoint from a single authenticated session.
Database error messages or long-running MySQL queries originating from the Cacti application user.
New or modified rows in Cacti tables that were not initiated by an administrator action.

Detection Strategies

Enable verbose web server logging for the Cacti application and alert on suspicious query strings targeting host_templates.php.
Deploy a web application firewall rule set that flags SQL injection payloads in the graph_template parameter.
Correlate MySQL general query logs with Cacti session identifiers to reveal injected statements.
Baseline the volume of host template requests per user and alert on outliers.

Monitoring Recommendations

Monitor Cacti version strings across the environment to identify hosts still running versions earlier than 1.2.29.
Watch for outbound connections from the Cacti server to unfamiliar destinations after suspicious template activity.
Track authentication failures followed by successful logins from the same source, which may indicate credential brute forcing prior to exploitation.

How to Mitigate CVE-2024-54146

Immediate Actions Required

Upgrade Cacti to version 1.2.29 or later on all instances.
Rotate credentials used by Cacti to access its MySQL database and any monitored devices.
Review recent Cacti audit logs and MySQL query logs for injection attempts against host_templates.php.
Restrict access to the Cacti web interface to trusted management networks using firewall or reverse proxy controls.

Patch Information

The upstream fix is included in Cacti 1.2.29. Refer to the GitHub Security Advisory GHSA-vj9g-p7f2-4wqj and the upstream commit c7e4ee7 for full details. The 1.2.29 release also addresses five additional security issues, including authenticated RCE and LFI vulnerabilities, so upgrading is preferable to any partial mitigation.

Workarounds

If immediate upgrade is not possible, remove or restrict access to host_templates.php at the web server layer.
Enforce least-privilege database permissions so the Cacti MySQL user cannot read sensitive tables outside its schema.
Require multi-factor authentication for all Cacti accounts to reduce the risk of credential-based access.

bash

# Upgrade Cacti to the patched release on a Linux host
cd /var/www/html
sudo wget https://www.cacti.net/downloads/cacti-1.2.29.tar.gz
sudo tar -xzf cacti-1.2.29.tar.gz
sudo cp -r cacti/* /var/www/html/cacti/
sudo php /var/www/html/cacti/cli/upgrade_database.php
sudo systemctl restart apache2