VYPR
← All advisories
Unrated severityNVD Advisory· Published May 13, 2024· Updated Dec 16, 2025

SQL Injection vulnerability in automation_get_new_graphs_sql

CVE-2024-31445

Description

Cacti provides an operational monitoring and fault management framework. Prior to version 1.2.27, a SQL injection vulnerability in automation_get_new_graphs_sql function of api_automation.php allows authenticated users to exploit these SQL injection vulnerabilities to perform privilege escalation and remote code execution. In api_automation.php line 856, the get_request_var('filter') is being concatenated into the SQL statement without any sanitization. In api_automation.php line 717, The filter of 'filter' is FILTER_DEFAULT, which means there is no filter for it. Version 1.2.27 contains a patch for the issue.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

13

Patches

Vulnerability mechanics

Root cause

"Missing input sanitization on the `filter` parameter allows SQL injection in `api_automation.php`."

Attack vector

An authenticated attacker crafts a malicious `filter` parameter in the HTTP request to `automation_graph_rules.php`. The payload is injected into the SQL query without sanitization [ref_id=1]. By appending SQL control characters (e.g., `%22);select sleep(10)--+`), the attacker can manipulate the query to execute arbitrary SQL commands, enabling privilege escalation and remote code execution [CWE-89].

Affected code

The vulnerability resides in `api_automation.php`, specifically in the `automation_get_new_graphs_sql` function. At line 856, the return value of `get_request_var('filter')` is concatenated directly into a SQL statement via `build_graph_object_sql_having($rule, get_request_var('filter'))`. The input filter for `'filter'` is set to `FILTER_DEFAULT` (line 717), meaning no sanitization is applied.

What the fix does

Version 1.2.27 applies a patch that sanitizes the `filter` input before it is used in the SQL query. The advisory does not show the exact diff, but the fix ensures the `filter` parameter is properly escaped or parameterized, preventing SQL injection.

Preconditions

  • authThe attacker must be an authenticated user of the Cacti application.
  • inputThe attacker must have access to the `automation_graph_rules.php` endpoint with a valid rule ID.

Generated on Jun 14, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

5

News mentions

0

No linked articles in our index yet.