CVE-2025-26520
📋 TL;DR
CVE-2025-26520 is an SQL injection vulnerability in Cacti's host_templates.php file via the graph_template parameter. This allows attackers to execute arbitrary SQL commands on the database. All Cacti installations up to version 1.2.29 are affected.
💻 Affected Systems
- Cacti
📦 What is this software?
Cacti by Cacti
⚠️ Risk & Real-World Impact
Worst Case
Full database compromise leading to data theft, privilege escalation, and potential remote code execution through database functions.
Likely Case
Unauthorized data access, modification of monitoring configurations, and potential authentication bypass.
If Mitigated
Limited impact if proper input validation and database permissions are enforced.
🎯 Exploit Status
Requires authentication to access host_templates.php, but SQL injection is straightforward once authenticated.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.2.30 or later
Vendor Advisory: https://github.com/Cacti/cacti/commit/7fa60c03ad4a69c701ac6b77c85a8927df7acd51
Restart Required: No
Instructions:
1. Backup your Cacti installation and database. 2. Download Cacti 1.2.30 or later from the official repository. 3. Replace affected files with patched versions. 4. Verify the fix by checking the commit hash includes 7fa60c03ad4a69c701ac6b77c85a8927df7acd51.
🔧 Temporary Workarounds
Input Validation Enhancement
allAdd additional input validation for graph_template parameter in host_templates.php
# Modify host_templates.php to sanitize graph_template input
# Ensure proper parameter binding in SQL queries
🧯 If You Can't Patch
- Restrict access to host_templates.php to trusted IP addresses only
- Implement web application firewall (WAF) rules to block SQL injection patterns
🔍 How to Verify
Check if Vulnerable:
Check Cacti version: if version <= 1.2.29, system is vulnerable. Review host_templates.php for proper input sanitization.Check Version:
grep '\$version' /path/to/cacti/include/global.php | head -1Verify Fix Applied:
Verify Cacti version is 1.2.30 or later. Check that the commit 7fa60c03ad4a69c701ac6b77c85a8927df7acd51 is applied.📡 Detection & Monitoring
Log Indicators:
- Unusual SQL queries in database logs
- Multiple failed authentication attempts followed by host_templates.php access
- Unexpected graph_template parameter values in web logs
Network Indicators:
- SQL error messages in HTTP responses
- Unusual database connection patterns from web server
SIEM Query:
source="web_logs" AND uri="/host_templates.php" AND (param="graph_template" AND value MATCHES "[';]|UNION|SELECT")