Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2025-24368

Cacti is an open source performance and fault management framework. Some of the data stored in automation_tree_rules.php is not thoroughly checked and is used to concatenate the SQL statement in build_rule_item_filter() function from lib/api_automation.php, resulting in SQL injection. This vulnerability is fixed in 1.2.29.

Published

2025-01-27T18:15:42.157

Last Modified

2025-04-18T02:21:31.887

Status

Analyzed

Source

[email protected]

Severity

CVSSv3.1: 7.5 (HIGH)

Weaknesses

Type: Primary
CWE-89

Affected Vendors & Products

Type	Vendor	Product	Version/Range	Vulnerable?
Application	cacti	cacti	< 1.2.29	Yes

References

https://github.com/Cacti/cacti/commit/c7e4ee798d263a3209ae6e7ba182c7b65284d8f0 Patch ([email protected])
https://github.com/Cacti/cacti/security/advisories/GHSA-f9c7-7rc3-574c Exploit, Third Party Advisory ([email protected])
https://github.com/Cacti/cacti/security/advisories/GHSA-f9c7-7rc3-574c Exploit, Third Party Advisory (134c704f-9b21-4f2e-91b3-4a467353bcc0)