high

CVE-2026-40083: Authenticated SQL Injection in Cacti <= 1.2.30 managers.php Exposes Full Database

1 fonte(s) · 1 atualização(ões) · publicado 27/08/2026 17:01 · coletado há 1 dia

The Yokai research team at Hakai Security disclosed CVE-2026-40083, a SQL injection vulnerability in Cacti versions up to and including 1.2.30. An authenticated user with SNMP management (agent) permissions can run arbitrary SQL queries, reading or modifying the entire database. Exposed data includes bcrypt credential hashes, API tokens, SNMP community strings and monitored infrastructure data. The flaw was reported through the GitHub Security Advisory program (GHSA-j9jv-6xjq-9hhj) and fixed in Cacti 1.2.31. Hakai published a public PoC script. The article does not report exploitation in the wild.

Technical Details

The flaw is in managers.php (lines 756-766 in release 1.2.30). The selected_graphs_array POST parameter is passed through cacti_unserialize() and the resulting array values are concatenated with implode() into a DELETE FROM snmpagent_managers WHERE id IN (...) query with no type validation or parameterization.
cacti_unserialize() blocks PHP Object Injection but does not restrict primitive values in the array, so attacker-controlled strings reach the SQL statement.
The endpoint is /cacti/managers.php, reached by HTTP POST. Validation used a time-based blind payload with SLEEP(), and the researchers wrote a Python exploitation script.
Time-delay queries could also exhaust simultaneous database connections and cause denial of service.
The article cites TheirStack data saying Cacti is used by over 2,000 companies.
The fix adds sanitize_unserialize_selected_items() and casts every element with array_map('intval', ...) before building the query.

Remediation

Upgrade Cacti to version 1.2.31 or later.
Restrict access to administrative functions to authorized users and apply least privilege, especially for SNMP management and agent permissions.

Linha do tempo

yokai.hakaisecurity.io ↗ · pub. 27/08/2026 17:01 · coletado 19/10 18:03 primeiro registro

CVE-2026-40083: Authenticated SQL Injection in Cacti <= 1.2.30 managers.php Exposes Full Database
ler a análise desta fonte ocultar
The Yokai research team at Hakai Security disclosed CVE-2026-40083, a SQL injection vulnerability in Cacti versions up to and including 1.2.30. An authenticated user with SNMP management (agent) permissions can run arbitrary SQL queries, reading or modifying the entire database. Exposed data includes bcrypt credential hashes, API tokens, SNMP community strings and monitored infrastructure data. The flaw was reported through the GitHub Security Advisory program (GHSA-j9jv-6xjq-9hhj) and fixed in Cacti 1.2.31. Hakai published a public PoC script. The article does not report exploitation in the wild.

Technical Details
- The flaw is in managers.php (lines 756-766 in release 1.2.30). The selected_graphs_array POST parameter is passed through cacti_unserialize() and the resulting array values are concatenated with implode() into a DELETE FROM snmpagent_managers WHERE id IN (...) query with no type validation or parameterization.
- cacti_unserialize() blocks PHP Object Injection but does not restrict primitive values in the array, so attacker-controlled strings reach the SQL statement.
- The endpoint is /cacti/managers.php, reached by HTTP POST. Validation used a time-based blind payload with SLEEP(), and the researchers wrote a Python exploitation script.
- Time-delay queries could also exhaust simultaneous database connections and cause denial of service.
- The article cites TheirStack data saying Cacti is used by over 2,000 companies.
- The fix adds sanitize_unserialize_selected_items() and casts every element with array_map('intval', ...) before building the query.
Remediation
- Upgrade Cacti to version 1.2.31 or later.
- Restrict access to administrative functions to authorized users and apply least privilege, especially for SNMP management and agent permissions.