CVE-2024-31460

Cacti provides an operational monitoring and fault management framework. Prior to version 1.2.27, some of the data stored in `automation_tree_rules.php` is not thoroughly checked and is used to concatenate the SQL statement in `create_all_header_nodes()` function from `lib/api_automation.php` , finally resulting in SQL injection. Using SQL based secondary injection technology, attackers can modify the contents of the Cacti database, and based on the modified content, it may be possible to achieve further impact, such as arbitrary file reading, and even remote code execution through arbitrary file writing. Version 1.2.27 contains a patch for the issue.

• CWE-89
• CWE-89

• https://github.com/Cacti/cacti/security/advisories/GHSA-cx8g-hvq8-p2rvExploit, Vendor Advisory
• https://github.com/Cacti/cacti/security/advisories/GHSA-gj3f-p326-gh8rExploit, Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RBEOAFKRARQHTDIYSL723XAFJ2Q6624X/Product
• https://github.com/Cacti/cacti/security/advisories/GHSA-cx8g-hvq8-p2rvExploit, Vendor Advisory
• https://github.com/Cacti/cacti/security/advisories/GHSA-gj3f-p326-gh8rExploit, Vendor Advisory
• https://lists.debian.org/debian-lts-announce/2024/09/msg00027.html
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RBEOAFKRARQHTDIYSL723XAFJ2Q6624X/Product

Published

May 14, 2024

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-31455Minder by Stacklok is an open source software supply chain s…4.3
• CVE-2024-31456GLPI is a Free Asset and IT Management Software package. Pri…6.5
• CVE-2024-31457gin-vue-admin is a backstage management system based on vue …7.7
• CVE-2024-31458Cacti provides an operational monitoring and fault managemen…8
• CVE-2024-31459Cacti provides an operational monitoring and fault managemen…7.2
• CVE-2024-3146A vulnerability classified as problematic has been found in …4.3
• CVE-2024-31461Plane, an open-source project management tool, has a Server-…9.1
• CVE-2024-31462stable-diffusion-webui is a web interface for Stable Diffusi…6.3
• CVE-2024-31463Ironic-image is an OpenStack Ironic deployment packaged and …4.7
• CVE-2024-31464XWiki Platform is a generic wiki platform. Starting in versi…4.9
• CVE-2024-31465XWiki Platform is a generic wiki platform. Starting in versi…8.8
• CVE-2024-31466There are buffer overflow vulnerabilities in the underlying …9.8