CVE-2024-31445
Published: 14 May 2024
Summary
CVE-2024-31445 is a high-severity SQL Injection (CWE-89) vulnerability in Cacti Cacti. Its CVSS base score is 8.8 (High).
Operationally, ranked in the top 2.6% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Deeper analysis
Cacti is an operational monitoring and fault management framework that contains a SQL injection vulnerability in the automation_get_new_graphs_sql function within api_automation.php prior to version 1.2.27. The issue stems from the get_request_var('filter') value being directly concatenated into an SQL statement at line 856 without sanitization, while the filter definition at line 717 uses FILTER_DEFAULT and therefore applies no validation. The flaw is tracked as CWE-89 and carries a CVSS 3.1 score of 8.8.
An authenticated user can supply a crafted filter parameter to execute arbitrary SQL, which in turn enables privilege escalation and remote code execution on the affected Cacti instance. The attack requires only network access and a low-privileged account; no user interaction is needed.
The project addressed the issue in version 1.2.27, with the fix published in commit fd93c6e on the Cacti repository. The accompanying GitHub Security Advisory GHSA-vjph-r677-6pcc and downstream Fedora package announcements recommend upgrading to the patched release.
EPSS for the CVE rose from lower values after disclosure to a peak of 0.5219 on 2025-12-11 before receding to the current 0.3947, indicating increased exploitation interest emerged post-publication.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-29334
Vulnerability details
Cacti provides an operational monitoring and fault management framework. Prior to version 1.2.27, a SQL injection vulnerability in `automation_get_new_graphs_sql` function of `api_automation.php` allows authenticated users to exploit these SQL injection vulnerabilities to perform privilege escalation and remote code execution. In…
more
`api_automation.php` line 856, the `get_request_var('filter')` is being concatenated into the SQL statement without any sanitization. In `api_automation.php` line 717, The filter of `'filter'` is `FILTER_DEFAULT`, which means there is no filter for it. Version 1.2.27 contains a patch for the issue.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.