Pre-Authentication SQL Injection in Cacti

Detection Guidance

The vulnerability is a pre-authentication SQL injection in Cacti's graph_view.php file affecting versions up to 1.2.30. Detection typically involves checking the version of Cacti installed and monitoring for suspicious HTTP requests targeting graph_view.php with potentially malicious input exploiting FILTER_VALIDATE_REGEXP.

Since this is a web application vulnerability, you can detect it by verifying the Cacti version via the application interface or command line, and by inspecting web server logs for unusual requests to graph_view.php.

• Check Cacti version to confirm if it is 1.2.30 or earlier (vulnerable):
• Command example to check installed Cacti version (assuming Linux and typical installation):
• grep 'Version' /path/to/cacti/include/config.php
• Or check the version via the web interface under About or similar section.
• Inspect web server access logs for suspicious requests to graph_view.php that may contain SQL injection payloads.
• Example command to search logs (adjust path and log file name accordingly):
• grep 'graph_view.php' /var/log/apache2/access.log | grep -i 'regexp'

For active detection, security scanners or web application firewalls (WAFs) with SQL injection detection rules can be used to identify attempts to exploit this vulnerability.

Useful 0 Not Useful 0

Executive Summary

This vulnerability exists in Cacti, an open source performance and fault management framework. Versions 1.2.30 and earlier have a pre-authentication SQL Injection vulnerability in the graph_view.php file due to an unanchored FILTER_VALIDATE_REGEXP. This means that an attacker can exploit this flaw without needing to authenticate, potentially injecting malicious SQL commands.

Useful 0 Not Useful 0

Impact Analysis

The vulnerability has a high severity with a CVSS score of 9.8, indicating it can have a critical impact. It allows an attacker to execute arbitrary SQL commands without authentication, which can lead to complete compromise of the database confidentiality, integrity, and availability. This could result in unauthorized data access, data modification, or denial of service.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, you should upgrade Cacti to version 1.2.31 or later, as this version contains the fix for the pre-authentication SQL Injection issue in graph_view.php.

Useful 0 Not Useful 0

Compliance Impact

The vulnerability in Cacti (CVE-2026-39955) is a critical pre-authentication SQL injection that can lead to high impacts on confidentiality, integrity, and availability of data.

Such impacts could potentially affect compliance with common standards and regulations like GDPR and HIPAA, which require protection of sensitive data and maintaining data integrity and availability.

However, the provided information does not explicitly state how this vulnerability directly affects compliance with these standards.

Useful 0 Not Useful 0