CVE-2026-71287 Overview
CVE-2026-71287 is a SQL injection vulnerability in Cacti, an open-source network monitoring and graphing platform. The flaw resides in the sanitize_sql_column() function within lib/functions.php, which sanitizes user-supplied ORDER BY column names using an overly permissive regex allowlist. Any authenticated Cacti user, regardless of privilege level, can inject SQL functions such as SLEEP() through the sort_column GET parameter. Affected scripts include user_log.php, utilities.php, user_domains.php, and user_group_admin.php. The vulnerability enables time-based blind SQL injection against the Cacti database [CWE-89].
Critical Impact
Authenticated attackers with any Cacti account can extract database contents, including credential hashes, through blind SQL injection in ORDER BY clauses that cannot be parameterized.
Affected Products
- Cacti (open-source network monitoring platform)
- lib/functions.php — sanitize_sql_column() function
- Scripts: user_log.php, utilities.php, user_domains.php, user_group_admin.php
Discovery Timeline
- 2026-08-05 - CVE-2026-71287 published to NVD
- 2026-08-05 - Last updated in NVD database
Technical Details for CVE-2026-71287
Vulnerability Analysis
Cacti's sanitize_sql_column() function attempts to safely handle user-supplied ORDER BY column names by filtering input through the regex preg_replace('/[^a-zA-Z0-9_().]/', '', $column). The allowlist preserves letters, digits, underscore, parentheses, and dot to support legitimate expressions like COUNT(id) and table.column. This design decision leaves the door open to SQL function calls.
A payload such as SLEEP(5) contains only allowlisted characters and passes through the sanitizer unchanged. The sanitized value is then concatenated directly into raw SQL ORDER BY clauses. ORDER BY clauses cannot be parameterized in prepared statements, so the vulnerability cannot be mitigated by binding parameters alone.
Root Cause
The root cause is an incomplete character allowlist combined with unsafe string concatenation into SQL. The regex trusts any input composed of alphanumerics, underscores, dots, and parentheses. It does not validate that the resulting string is an actual column name from a known schema. Function invocations and nested SQL expressions therefore survive sanitization intact.
Attack Vector
An authenticated attacker sends a crafted HTTP GET request with the sort_column parameter set to a time-delay payload such as SLEEP(5) or a conditional expression like IF(SUBSTRING(user_auth.password,1,1)='a',SLEEP(5),0). The injected SQL executes against the Cacti database backend. Boolean and time-based inference techniques allow attackers to extract arbitrary data, including password hashes stored in user_auth, one bit at a time. Exploitation requires only a low-privilege authenticated session.
See the Cacti functions.php source for the affected sanitizer implementation.
Detection Methods for CVE-2026-71287
Indicators of Compromise
- HTTP requests to user_log.php, utilities.php, user_domains.php, or user_group_admin.php containing sort_column values with SLEEP, BENCHMARK, IF(, SUBSTRING, or SELECT substrings.
- Unusually long response times from Cacti pages that accept the sort_column parameter.
- Repeated authenticated requests from a single session iterating through sort_column values, consistent with blind extraction.
Detection Strategies
- Inspect web server access logs for sort_column values containing parentheses combined with SQL function names.
- Enable MySQL/MariaDB slow query logging and correlate long-running ORDER BY queries with Cacti session identifiers.
- Deploy web application firewall rules that flag SQL keywords in query string parameters used for sort operations.
Monitoring Recommendations
- Alert on any Cacti authenticated session generating requests whose response latency exceeds normal baselines by multiples of a second.
- Track and rate-limit request volume per Cacti user account to surface automated blind SQLi extraction.
- Audit the user_auth table access patterns and warn on unexpected reads outside authentication flows.
How to Mitigate CVE-2026-71287
Immediate Actions Required
- Restrict Cacti access to trusted networks using firewall rules or VPN gating until a patch is applied.
- Rotate all Cacti user credentials and any database credentials that may have been exposed through the affected pages.
- Review web server logs for prior exploitation attempts targeting sort_column on the affected scripts.
Patch Information
No fixed version was listed in the NVD record at publication. Monitor the Cacti GitHub repository for updates to lib/functions.php and apply security releases as soon as they are available.
Workarounds
- Replace the allowlist in sanitize_sql_column() with a strict check against a hardcoded list of valid column names per calling script.
- Reject any sort_column value containing ( or ) at a reverse proxy or WAF layer if legitimate expressions are not required.
- Temporarily disable or restrict access to user_log.php, utilities.php, user_domains.php, and user_group_admin.php for non-administrative users.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
