CVE-2025-24368: Cacti has a SQL Injection vulnerability when using tree rules through Automation API
Cacti is an open source performance and fault management framework. Some of the data stored in automationtreerules.php is not thoroughly checked and is used to concatenate the SQL statement in buildruleitemfilter() function from lib/apiautomation.php, resulting in SQL injection. This vulnerability is fixed in 1.2.29.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/cactito a version that resolves this vulnerability.Fixed in 1.2.24+ds1-1+deb12u5Fixed in 1.2.30+ds1-1Fixed in 1.2.31+ds1-4 - Upgrade
Upgrade
alpine/cactito a version that resolves this vulnerability.Fixed in 1.2.29-r0 - Upgrade
Upgrade
Cactito a version that resolves this vulnerability.Fixed in 1.2.29
Event History
Frequently Asked Questions
What is the severity of CVE-2025-24368?
CVE-2025-24368 has a high severity rating due to its potential for SQL injection attacks.
How do I fix CVE-2025-24368?
To fix CVE-2025-24368, upgrade to Cacti version 1.2.30 or later where the vulnerability is patched.
What version of Cacti is affected by CVE-2025-24368?
CVE-2025-24368 affects Cacti versions up to 1.2.29 exclusively.
What kind of vulnerability is CVE-2025-24368?
CVE-2025-24368 is a SQL injection vulnerability that can expose sensitive data.
Which file is involved in CVE-2025-24368?
The vulnerability in CVE-2025-24368 involves the automation_tree_rules.php file and its interaction with the build_rule_item_filter() function.