High severity8.8NVD Advisory· Published Dec 22, 2023· Updated Jun 17, 2026

CVE-2023-51448

Description

Cacti provides an operational monitoring and fault management framework. Version 1.2.25 has a Blind SQL Injection (SQLi) vulnerability within the SNMP Notification Receivers feature in the file ‘managers.php’. An authenticated attacker with the “Settings/Utilities” permission can send a crafted HTTP GET request to the endpoint ‘/cacti/managers.php’ with an SQLi payload in the ‘selected_graphs_array’ HTTP GET parameter. As of time of publication, no patched versions exist.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Cacti (software)/Cactillm-fuzzy2 versions
<1.2.25+ 1 more
- (no CPE)range: <1.2.25
- (no CPE)range: <= 1.2.25
osv-coords7 versions
pkg:rpm/opensuse/cacti&distro=openSUSE%20Tumbleweed pkg:rpm/suse/cacti&distro=SUSE%20Package%20Hub%2012 pkg:rpm/suse/cacti-spine&distro=SUSE%20Package%20Hub%2012 pkg:rpm/suse/cacti&distro=SUSE%20Package%20Hub%2015%20SP5 pkg:rpm/opensuse/cacti&distro=openSUSE%20Leap%2015.5 pkg:rpm/opensuse/cacti-spine&distro=openSUSE%20Leap%2015.5 pkg:rpm/suse/cacti-spine&distro=SUSE%20Package%20Hub%2015%20SP5
< 1.2.26-1.1+ 6 more
- (no CPE)range: < 1.2.26-1.1
- (no CPE)range: < 1.2.26-bp155.2.6.1
- (no CPE)range: < 1.2.26-bp155.2.6.1
- (no CPE)range: < 1.2.26-bp155.2.6.1
- (no CPE)range: < 1.2.26-bp155.2.6.1
- (no CPE)range: < 1.2.26-bp155.2.6.1
- (no CPE)range: < 1.2.26-bp155.2.6.1

Patches

Vulnerability mechanics

References

github.com/Cacti/cacti/blob/5f6f65c215d663a775950b2d9db35edbaf07d680/managers.phpnvdExploitVendor Advisory
github.com/Cacti/cacti/security/advisories/GHSA-w85f-7c4w-7594nvdExploitVendor Advisory
lists.fedoraproject.org/archives/list/[email protected]/message/RBEOAFKRARQHTDIYSL723XAFJ2Q6624X/nvd

News mentions

No linked articles in our index yet.

cvss	0.572
epss	0.053
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000