Skip to content

SQL Injection vulnerability when view host template

Moderate
netniV published GHSA-vj9g-p7f2-4wqj Jan 26, 2025

Package

Cacti (PHP)

Affected versions

1.2.28

Patched versions

1.2.29

Description

Summary

A SQL injection vulnerability in template function of host_templates.phpparamter graph_templatewithout any filter.

Discoverer

LoRexxar@Qianxin Tiangong Lab

Details

In host_templates.php line 852

	if (get_request_var('graph_template') != '-1') {
		$sql_where .= ($sql_where != '' ? ' AND ':'WHERE ') . '(gt_id = ' . get_request_var('graph_template') . ')';
		$sql_join   = "INNER JOIN (
			SELECT DISTINCT host_template_id, id AS gt_id
			FROM (
				SELECT htg.host_template_id, gt.id
				FROM graph_templates AS gt
				INNER JOIN host_template_graph AS htg
				ON htg.graph_template_id = gt.id
				UNION
				SELECT htsq.host_template_id, gt.id
				FROM graph_templates AS gt
				INNER JOIN snmp_query_graph AS sqg
				ON gt.id = sqg.graph_template_id
				INNER JOIN host_template_snmp_query AS htsq
				ON sqg.snmp_query_id = htsq.snmp_query_id
			) AS rs
		) AS htdata
		ON htdata.host_template_id = ht.id";
	}

The is being concatenated into the SQL statement .
In host_templates.php line 644

		'graph_template' => array(
			'filter' => FILTER_DEFAULT,
			'pageset' => true,
			'default' => '-1'
		),

filter of is FILTER_DEFAULT, that means param graph_templatewithout any filter.

PoC

http://127.0.0.1/cacti/host_templates.php?graph_template=slepp(1)
set graph_templateinto sql statement.
image

Severity

Moderate

CVSS overall score

This score calculates overall vulnerability severity from 0 to 10 and is based on the Common Vulnerability Scoring System (CVSS).
/ 10

CVSS v3 base metrics

Attack vector
Network
Attack complexity
Low
Privileges required
Low
User interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

CVSS v3 base metrics

Attack vector: More severe the more the remote (logically and physically) an attacker can be in order to exploit the vulnerability.
Attack complexity: More severe for the least complex attacks.
Privileges required: More severe if no privileges are required.
User interaction: More severe when no user interaction is required.
Scope: More severe when a scope change occurs, e.g. one vulnerable component impacts resources in components beyond its security scope.
Confidentiality: More severe when loss of data confidentiality is highest, measuring the level of data access available to an unauthorized user.
Integrity: More severe when loss of data integrity is the highest, measuring the consequence of data modification possible by an unauthorized user.
Availability: More severe when the loss of impacted component availability is highest.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

CVE ID

CVE-2024-54146

Weaknesses

No CWEs

Credits