CVE-2025-24368

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2025-24368
Cacti is an open source performance and fault management framework. Some of the data stored in automation_tree_rules.php is not thoroughly checked and is used to concatenate the SQL statement in build_rule_item_filter() function from lib/api_automation.php, resulting in SQL injection. This vulnerability is fixed in 1.2.29.

7.5 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://github.com/Cacti/cacti/commit/c7e4ee798d263a3209ae6e7ba182c7b65284d8f0 Patch
https://github.com/Cacti/cacti/security/advisories/GHSA-f9c7-7rc3-574c Exploit Third Party Advisory
https://github.com/Cacti/cacti/security/advisories/GHSA-f9c7-7rc3-574c Exploit Third Party Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:cacti:cacti:*:*:*:*:*:*:*:*
History

18 Apr 2025, 02:21

Type Values Removed Values Added
References () https://github.com/Cacti/cacti/commit/c7e4ee798d263a3209ae6e7ba182c7b65284d8f0 - () https://github.com/Cacti/cacti/commit/c7e4ee798d263a3209ae6e7ba182c7b65284d8f0 - Patch
References () https://github.com/Cacti/cacti/security/advisories/GHSA-f9c7-7rc3-574c - () https://github.com/Cacti/cacti/security/advisories/GHSA-f9c7-7rc3-574c - Exploit, Third Party Advisory
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 7.5
Summary
  • (es) Cacti es un sistema de gestión de errores y rendimiento de código abierto framework. Algunos de los datos almacenados en automation_tree_rules.php no se comprueban exhaustivamente y se utilizan para concatenar la declaración SQL en la función build_rule_item_filter() de lib/api_automation.php, lo que da como resultado una inyección SQL. Esta vulnerabilidad se solucionó en la versión 1.2.29.
CPE cpe:2.3:a:cacti:cacti:*:*:*:*:*:*:*:*
First Time Cacti
Cacti cacti

27 Jan 2025, 19:15

Type Values Removed Values Added
References () https://github.com/Cacti/cacti/security/advisories/GHSA-f9c7-7rc3-574c - () https://github.com/Cacti/cacti/security/advisories/GHSA-f9c7-7rc3-574c -

27 Jan 2025, 18:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-01-27 18:15

Updated : 2025-04-18 02:21

NVD link : CVE-2025-24368

Mitre link : CVE-2025-24368

CVE.ORG link : CVE-2025-24368

JSON object : View

Products Affected

cacti

  • cacti
CWE
CWE-89

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')