SQL injection vulnerability in the host_new_graphs_save function in graphs_new.php in Cacti 0.8.8f and earlier allows remote authenticated u

Affected versions

NVD version ranges (for catalog products). Add the product to your stack with a version and matching uses these.

• cacti cactiup to 0.8.8f inclusive

Package-level exposure

OSV and GitHub Advisory data: ecosystem, package and range. SBOM matching uses this table.

Other highest-scoring records for the same primary product.

• CVE-2022-46169Unauthenticated Command InjectionKEV
  99Now
• CVE-2024-29895Cacti command injection in cmd_realtime.php
  70This week
• CVE-2023-39361Unauthenticated SQL Injection in graph_view.php in Cacti
  66This week
• CVE-2023-49085Cacti SQL Injection vulnerability
  57Plan
• CVE-2020-8813graph_realtime.php in Cacti 1.2.8 allows remote attackers to execute arbitrary OS commands via shell metacharacters in a cookie, if a guest
  57Plan
• CVE-2023-51448SQL Injection vulnerability when managing SNMP Notification Receivers
  55Plan

FIRST EPSS daily score; only changes of 0.01 or more are recorded (step chart).

Root cause

The query text is built by concatenating user input. The database cannot tell where the data ends and the command begins.

A representative example of this vulnerability class. Not the vendor's source code; it shows the faulty pattern and its fix.

1const owner = req.query.owner;2const rows = await db.query(3  "SELECT * FROM files WHERE owner = '" + owner + "'"4);

1const owner = req.query.owner;2const rows = await db.query(3  "SELECT * FROM files WHERE owner = $1",4  [owner]5);

Attack context

MITRE CAPEC attack patterns and ATT&CK techniques for this weakness class (CWE). A starting point for detection rules and threat hunting.