CVE-2026-71287

Summary

Cacti's sanitize_sql_column() (lib/functions.php) sanitizes user-supplied ORDER BY column names using the regex preg_replace('/[^a-zA-Z0-9_().]/', '', $column). Because this allowlist retains letters, digits, underscore, parentheses, and dot (intended to support expressions like COUNT(id) and table.column), a payload such as SLEEP(5) passes through completely unmodified. The sanitized value is concatenated directly into raw SQL ORDER BY clauses (which cannot be parameterized) driven by a sort_column GET parameter in at least user_log.php, utilities.php, user_domains.php, and user_group_admin.php, allowing any authenticated Cacti user, regardless of privilege level, to perform time-based blind SQL injection against the Cacti database.

Affected Software

Weaknesses

• CWE-89: CWE-89

ADP Enrichment

CISA ADP Vulnrichment

• SSVC:
• Exploitation: none
  • Automatable: no
  • Technical Impact: total

References

• https://github.com/Cacti/cacti
• https://github.com/Cacti/cacti/blob/develop/lib/functions.php

• ←Previous
• Next→