CVE-2024-31445 – This SQL injection vulnerability in Cacti allow... (How to Fix)

Q: What is the severity of CVE-2024-31445?

CVE-2024-31445 has a CVSS score of 8.8 (HIGH). This SQL injection vulnerability in Cacti allows authenticated users to execute arbitrary SQL commands, potentially leading to privilege escalation and remote code execution. It affects all Cacti installations prior to version 1.2.27 where users have authenticated access to the automation API.

📋 TL;DR

This SQL injection vulnerability in Cacti allows authenticated users to execute arbitrary SQL commands, potentially leading to privilege escalation and remote code execution. It affects all Cacti installations prior to version 1.2.27 where users have authenticated access to the automation API.

💻 Affected Systems

Products:

Cacti

Versions: All versions prior to 1.2.27

Operating Systems: All platforms running Cacti

Default Config Vulnerable: ⚠️ Yes

Notes: Requires authenticated user access to the automation API endpoint. Default installations with user accounts are vulnerable.

📦 What is this software?

Cacti by Cacti

View all CVEs affecting Cacti →

Fedora by Fedoraproject

View all CVEs affecting Fedora →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Full system compromise via remote code execution, data exfiltration, and complete control over the Cacti server and potentially underlying systems.

🟠

Likely Case

Privilege escalation within Cacti leading to administrative access, data manipulation, and potential lateral movement within the network.

🟢

If Mitigated

Limited impact due to proper network segmentation, minimal user privileges, and monitoring that detects SQL injection attempts.

🌐 Internet-Facing: HIGH

🏢 Internal Only: HIGH

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: LIKELY

Unauthenticated Exploit: ✅ No

Complexity: LOW

Exploitation requires authenticated access but the SQL injection is straightforward. Public exploit code may emerge given the high CVSS score and RCE potential.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: 1.2.27

Vendor Advisory: https://github.com/Cacti/cacti/security/advisories/GHSA-vjph-r677-6pcc

Restart Required: No

Instructions:

1. Backup your Cacti database and configuration. 2. Download Cacti 1.2.27 from the official repository. 3. Follow the Cacti upgrade documentation to apply the update. 4. Verify the patch is applied by checking the version.

🔧 Temporary Workarounds

Restrict API Access

all

Block or restrict access to the vulnerable API endpoint (/api_automation.php) at the web server or firewall level.

# Apache example: RewriteRule ^/api_automation\.php$ - [F]
# Nginx example: location ~ /api_automation\.php$ { deny all; }

Minimize User Privileges

all

Review and reduce user permissions to only necessary functions, removing automation API access where possible.

🧯 If You Can't Patch

Implement strict network segmentation to isolate Cacti servers from critical systems
Enable detailed logging and monitoring for SQL injection attempts and unusual API activity

🔍 How to Verify

Check if Vulnerable:

Check Cacti version via web interface (Console > About) or command line: grep 'cacti_version' /path/to/cacti/include/global.php

Check Version:

grep "cacti_version" /path/to/cacti/include/global.php | cut -d"'" -f4

Verify Fix Applied:

Confirm version is 1.2.27 or higher and check that the vulnerable lines in api_automation.php have been patched (lines 717 and 856 should show proper input validation).

📡 Detection & Monitoring

Log Indicators:

Unusual SQL queries in Cacti logs
Multiple failed authentication attempts followed by API access
Suspicious patterns in automation API requests

Network Indicators:

Unusual outbound connections from Cacti server
Traffic to /api_automation.php with SQL injection patterns

SIEM Query:

source="cacti.log" AND ("api_automation" OR "automation_get_new_graphs_sql") AND ("UNION" OR "SELECT" OR "INSERT" OR "DELETE" OR suspicious_patterns)

📊 Metadata

CVE ID: CVE-2024-31445

CVSS v3 Score: 8.8 (HIGH)

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE: CWE-89

Published: May 14, 2024

Last Updated: November 4, 2025

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2024-31445, you might also want to check these: