CVE-2026-71287: Cacti sanitize_sql_column() Regex Allowlist Permits SQL Time-Delay Functions Leading to Blind SQL Injection

Cacti's sanitizesqlcolumn() (lib/functions.php) sanitizes user-supplied ORDER BY column names using the regex pregreplace('/[^a-zA-Z0-9().]/', '', $column). Because this allowlist retains letters, digits, underscore, parentheses, and dot (intended to support expressions like COUNT(id) and table.column), a payload such as SLEEP(5) passes through completely unmodified. The sanitized value is concatenated directly into raw SQL ORDER BY clauses (which cannot be parameterized) driven by a sortcolumn GET parameter in at least userlog.php, utilities.php, userdomains.php, and usergroupadmin.php, allowing any authenticated Cacti user, regardless of privilege level, to perform time-based blind SQL injection against the Cacti database.