CVE-2024-31445: SQL Injection vulnerability in automation_get_new_graphs_sql
Cacti provides an operational monitoring and fault management framework. Prior to version 1.2.27, a SQL injection vulnerability in automationgetnewgraphssql function of apiautomation.php allows authenticated users to exploit these SQL injection vulnerabilities to perform privilege escalation and remote code execution. In apiautomation.php line 856, the getrequestvar('filter') is being concatenated into the SQL statement without any sanitization. In apiautomation.php line 717, The filter of 'filter' is FILTERDEFAULT, which means there is no filter for it. Version 1.2.27 contains a patch for the issue.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-31445?
CVE-2024-31445 is classified as a medium severity SQL injection vulnerability that affects specific versions of Cacti.
How do I fix CVE-2024-31445?
To resolve CVE-2024-31445, update Cacti to version 1.2.27 or later.
Who is affected by CVE-2024-31445?
CVE-2024-31445 affects authenticated users of Cacti versions prior to 1.2.27.
What kind of attack can CVE-2024-31445 facilitate?
CVE-2024-31445 can allow authenticated users to execute arbitrary SQL queries, potentially compromising the database.
When was CVE-2024-31445 discovered?
CVE-2024-31445 was identified in the Cacti framework before the release of version 1.2.27.