CVE-2024-31445

Cacti provides an operational monitoring and fault management framework. Prior to version 1.2.27, a SQL injection vulnerability in `automation_get_new_graphs_sql` function of `api_automation.php` allows authenticated users to exploit these SQL injection vulnerabilities to perform privilege escalation and remote code execution. In `api_automation.php` line 856, the `get_request_var('filter')` is being concatenated into the SQL statement without any sanitization. In `api_automation.php` line 717, The filter of `'filter'` is `FILTER_DEFAULT`, which means there is no filter for it. Version 1.2.27 contains a patch for the issue.

• CWE-89
• CWE-89

• https://github.com/Cacti/cacti/blob/501712998589763d411a68d35e3cda98fd9cfd18/lib/api_automation.php#L717Product
• https://github.com/Cacti/cacti/blob/501712998589763d411a68d35e3cda98fd9cfd18/lib/api_automation.php#L856Product
• https://github.com/Cacti/cacti/commit/fd93c6e47651958b77c3bbe6a01fff695f81e886Patch
• https://github.com/Cacti/cacti/security/advisories/GHSA-vjph-r677-6pccExploit, Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RBEOAFKRARQHTDIYSL723XAFJ2Q6624X/Product
• https://github.com/Cacti/cacti/blob/501712998589763d411a68d35e3cda98fd9cfd18/lib/api_automation.php#L717Product
• https://github.com/Cacti/cacti/blob/501712998589763d411a68d35e3cda98fd9cfd18/lib/api_automation.php#L856Product
• https://github.com/Cacti/cacti/commit/fd93c6e47651958b77c3bbe6a01fff695f81e886Patch
• https://github.com/Cacti/cacti/security/advisories/GHSA-vjph-r677-6pccExploit, Vendor Advisory
• https://lists.debian.org/debian-lts-announce/2024/09/msg00027.html
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RBEOAFKRARQHTDIYSL723XAFJ2Q6624X/Product

Published

May 14, 2024

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-31435: Missing Authorization vulnerability in Inisev Social Media…4.3
• CVE-2024-3144A vulnerability was found in DedeCMS 5.7. It has been declar…4.3
• CVE-2024-31441DataEase is an open source data visualization analysis tool.…7.5
• CVE-2024-31442Redon Hub is a Roblox Product Delivery Bot, also known as a …8.8
• CVE-2024-31443Cacti provides an operational monitoring and fault managemen…5.4
• CVE-2024-31444Cacti provides an operational monitoring and fault managemen…5.4
• CVE-2024-31446OpenComputers is a Minecraft mod that adds programmable comp…7.7
• CVE-2024-31447Shopware 6 is an open commerce platform based on Symfony Fra…5.3
• CVE-2024-31448Combodo iTop is a simple, web based IT Service Management to…6.1
• CVE-2024-31449Redis is an open source, in-memory database that persists on…8.8
• CVE-2024-3145A vulnerability was found in DedeCMS 5.7. It has been rated …4.3
• CVE-2024-31450Owncast is an open source, self-hosted, decentralized, singl…6.5