CVE-2026-71287
Received Received - Intake

SQL Injection in Cacti via ORDER BY Parameter

Publication date: 2026-08-05

Last updated on: 2026-08-05

Assigner: 309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c

Description
Cacti's sanitize_sql_column() (lib/functions.php) sanitizes user-supplied ORDER BY column names using the regex `preg_replace('/[^a-zA-Z0-9_().]/', '', $column)`. Because this allowlist retains letters, digits, underscore, parentheses, and dot (intended to support expressions like COUNT(id) and table.column), a payload such as `SLEEP(5)` passes through completely unmodified. The sanitized value is concatenated directly into raw SQL ORDER BY clauses (which cannot be parameterized) driven by a `sort_column` GET parameter in at least user_log.php, utilities.php, user_domains.php, and user_group_admin.php, allowing any authenticated Cacti user, regardless of privilege level, to perform time-based blind SQL injection against the Cacti database.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-05
Last Modified
2026-08-05
Generated
2026-08-05
AI Q&A
2026-08-05
EPSS Evaluated
N/A
NVD
CVE-2026-71287
EUVD
EUVD-2026-53372

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
cacti cacti *
cacti cacti 1.2.30
cacti cacti 1.3.0-beta

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-89 The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a SQL injection vulnerability in Cacti where user-supplied column names in ORDER BY clauses are not properly sanitized. The regex used to clean input allows characters like parentheses and dots, which lets malicious payloads such as SQL commands like SLEEP(5) bypass filtering. These payloads are then executed directly in raw SQL queries.

Detection Guidance

Check Cacti logs for unusual SQL queries or time delays in responses. Inspect GET parameters like sort_column in user_log.php, utilities.php, user_domains.php, and user_group_admin.php for payloads like SLEEP(5). Test with authenticated requests containing SQL injection patterns such as ' OR 1=1 --.

Impact Analysis

An attacker with authenticated access can exploit this to execute arbitrary SQL commands on the Cacti database. This could lead to unauthorized data access, modification, or deletion. The impact includes potential data breaches, system compromise, and disruption of Cacti services.

Compliance Impact

This vulnerability could lead to unauthorized access or exposure of sensitive data, violating GDPR and HIPAA requirements for data protection and confidentiality. Organizations using Cacti may face compliance violations, legal penalties, and reputational damage if exploited.

Mitigation Strategies

Update Cacti to the latest patched version. Restrict database user permissions to limit SQL injection impact. Disable ORDER BY clauses in user-facing pages if not essential. Monitor database queries for suspicious activity.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-71287. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart