{"id":"CVE-2023-51448","aliases":["ALPINE-CVE-2023-51448","DEBIAN-CVE-2023-51448","EUVD-2023-56163","GHSA-w85f-7c4w-7594","UBUNTU-CVE-2023-51448","openSUSE-SU-2024:0031-1","openSUSE-SU-2024:13533-1"],"status":"published","title":"SQL Injection vulnerability when managing SNMP Notification Receivers","description":"Cacti provides an operational monitoring and fault management framework. Version 1.2.25 has a Blind SQL Injection (SQLi) vulnerability within the SNMP Notification Receivers feature in the file `‘managers.php’`. An authenticated attacker with the “Settings/Utilities” permission can send a crafted HTTP GET request to the endpoint `‘/cacti/managers.php’` with an SQLi payload in the `‘selected_graphs_array’` HTTP GET parameter. As of time of publication, no patched versions exist.","severity":{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.67338,"percentile":0.99313,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-89"],"published":"2023-12-22T16:44:57Z","modified":"2026-11-03T06:32:43Z","fixes":[{"ecosystem":"Alpine:v3.18","package":"cacti","fixed_in":["1.2.26-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"cacti","fixed_in":["1.2.26-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"cacti","fixed_in":["1.2.26-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"cacti","fixed_in":["1.2.26-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"cacti","fixed_in":["1.2.26-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"cacti","fixed_in":["1.2.26-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"cacti","fixed_in":["1.2.26-r0"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"cacti","fixed_in":["1.2.26+ds1-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"cacti","fixed_in":["1.2.26+ds1-1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.18","package":"cacti","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.26-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"cacti","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.26-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"cacti","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.26-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"cacti","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.26-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"cacti","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.26-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"cacti","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.26-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"cacti","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.26-r0"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"cacti","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.26+ds1-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"cacti","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.26+ds1-1"}]}]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"cacti","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.8.8b+dfsg-3","0.8.8b+dfsg-5","0.8.8b+dfsg-5ubuntu0.1","0.8.8b+dfsg-5ubuntu0.2","0.8.8b+dfsg-5ubuntu0.2+esm1","0.8.8b+dfsg-5ubuntu0.2+esm2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"cacti","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.8.8f+ds1-2","0.8.8f+ds1-3","0.8.8f+ds1-4","0.8.8f+ds1-4ubuntu1","0.8.8f+ds1-4ubuntu2","0.8.8f+ds1-4ubuntu3","0.8.8f+ds1-4ubuntu4","0.8.8f+ds1-4ubuntu4.16.04","0.8.8f+ds1-4ubuntu4.16.04.1","0.8.8f+ds1-4ubuntu4.16.04.2","0.8.8f+ds1-4ubuntu4.16.04.2+esm1","0.8.8f+ds1-4ubuntu4.16.04.2+esm2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"cacti","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.1.18+ds1-1","1.1.27+ds1-2","1.1.27+ds1-3","1.1.28+ds1-2","1.1.35+ds1-1","1.1.36+ds1-1","1.1.38+ds1-1","1.1.38+ds1-1ubuntu0.1~esm1","1.1.38+ds1-1ubuntu0.1~esm3","1.1.38+ds1-1ubuntu0.1~esm4"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"cacti","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.2.4+ds1-2ubuntu3","1.2.9+ds1-1ubuntu1","1.2.9+ds1-1ubuntu2","1.2.10+ds1-1ubuntu1","1.2.10+ds1-1ubuntu1+esm1","1.2.10+ds1-1ubuntu1.1","1.2.10+ds1-1ubuntu1.1+esm1","1.2.10+ds1-1ubuntu1.1+esm2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"cacti","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.2.16+ds1-2ubuntu1","1.2.19+ds1-2ubuntu1","1.2.19+ds1-2ubuntu1+esm1","1.2.19+ds1-2ubuntu1.1","1.2.19+ds1-2ubuntu1.1+esm1","1.2.19+ds1-2ubuntu1.1+esm2"]},{"source":"osv","ecosystem":"SUSE:Package Hub 12","package":"cacti","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.26-bp155.2.6.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Package Hub 12","package":"cacti-spine","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.26-bp155.2.6.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Package Hub 15 SP5","package":"cacti","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.26-bp155.2.6.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Package Hub 15 SP5","package":"cacti-spine","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.26-bp155.2.6.1"}]}],"bundled":6},{"source":"osv","ecosystem":"openSUSE:Leap 15.5","package":"cacti","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.26-bp155.2.6.1"}]}],"bundled":6},{"source":"osv","ecosystem":"openSUSE:Leap 15.5","package":"cacti-spine","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.26-bp155.2.6.1"}]}],"bundled":6},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"cacti","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.26-1.1"}]}],"bundled":6}],"products":[{"vendor":"cacti","product":"cacti"}],"references":[{"url":"https://github.com/Cacti/cacti/security/advisories/GHSA-w85f-7c4w-7594","tags":["x_refsource_CONFIRM","x_transferred","Exploit","Vendor Advisory","advisory","report"]},{"url":"https://github.com/Cacti/cacti/blob/5f6f65c215d663a775950b2d9db35edbaf07d680/managers.php#L941","tags":["x_refsource_MISC","x_transferred","Exploit","Vendor Advisory","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RBEOAFKRARQHTDIYSL723XAFJ2Q6624X/","tags":["x_transferred","web"]},{"url":"https://security.alpinelinux.org/vuln/CVE-2023-51448","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/51xxx/CVE-2023-51448.json","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-51448","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2023-51448","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2023-51448","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-51448","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/IZJKJNYP7JFJ3XMRIGZT22J5DIAVPSY7/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1218360","tags":["report"]},{"url":"https://bugzilla.suse.com/1218366","tags":["report"]},{"url":"https://bugzilla.suse.com/1218378","tags":["report"]},{"url":"https://bugzilla.suse.com/1218379","tags":["report"]},{"url":"https://bugzilla.suse.com/1218380","tags":["report"]},{"url":"https://bugzilla.suse.com/1218381","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2023-49084","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-49085","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-49086","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-49088","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-50250","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-51448","tags":["web"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2023-51448","title":"SQL Injection vulnerability when managing SNMP Notification Receivers","description":"Cacti provides an operational monitoring and fault management framework. Version 1.2.25 has a Blind SQL Injection (SQLi) vulnerability within the SNMP Notification Receivers feature in the file `‘managers.php’`. An authenticated attacker with the “Settings/Utilities” permission can send a crafted HTTP GET request to the endpoint `‘/cacti/managers.php’` with an SQLi payload in the `‘selected_graphs_array’` HTTP GET parameter. As of time of publication, no patched versions exist.","status":"published","published":"2023-12-22T16:44:57.007Z","modified":"2025-02-13T17:19:45.658Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-89"],"updated_at":"2026-11-02T14:35:17.812395Z"}],"euvd":[{"id":"EUVD-2023-56163","description":"Cacti provides an operational monitoring and fault management framework. Version 1.2.25 has a Blind SQL Injection (SQLi) vulnerability within the SNMP Notification Receivers feature in the file `‘managers.php’`. An authenticated attacker with the “Settings/Utilities” permission can send a crafted HTTP GET request to the endpoint `‘/cacti/managers.php’` with an SQLi payload in the `‘selected_graphs_array’` HTTP GET parameter. As of time of publication, no patched versions exist.","status":"published","published":"2023-12-22T16:44:57Z","modified":"2025-02-13T17:19:45Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-03T00:03:48.029386Z"}],"nvd":[{"id":"CVE-2023-51448","description":"Cacti provides an operational monitoring and fault management framework. Version 1.2.25 has a Blind SQL Injection (SQLi) vulnerability within the SNMP Notification Receivers feature in the file `‘managers.php’`. An authenticated attacker with the “Settings/Utilities” permission can send a crafted HTTP GET request to the endpoint `‘/cacti/managers.php’` with an SQLi payload in the `‘selected_graphs_array’` HTTP GET parameter. As of time of publication, no patched versions exist.","status":"published","published":"2023-12-22T17:15:09.96Z","modified":"2026-06-17T06:40:58.84Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"},{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"}],"cwes":["CWE-89"],"updated_at":"2026-11-02T14:08:57.117371Z"}],"osv":[{"id":"ALPINE-CVE-2023-51448","description":"Cacti provides an operational monitoring and fault management framework. Version 1.2.25 has a Blind SQL Injection (SQLi) vulnerability within the SNMP Notification Receivers feature in the file `‘managers.php’`. An authenticated attacker with the “Settings/Utilities” permission can send a crafted HTTP GET request to the endpoint `‘/cacti/managers.php’` with an SQLi payload in the `‘selected_graphs_array’` HTTP GET parameter. As of time of publication, no patched versions exist.","status":"published","published":"2023-12-22T17:15:09.96Z","modified":"2026-11-03T06:32:43.915151968Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-03T07:17:02.90744Z"},{"id":"CVE-2023-51448","title":"SQL Injection vulnerability when managing SNMP Notification Receivers","description":"Cacti provides an operational monitoring and fault management framework. Version 1.2.25 has a Blind SQL Injection (SQLi) vulnerability within the SNMP Notification Receivers feature in the file `‘managers.php’`. An authenticated attacker with the “Settings/Utilities” permission can send a crafted HTTP GET request to the endpoint `‘/cacti/managers.php’` with an SQLi payload in the `‘selected_graphs_array’` HTTP GET parameter. As of time of publication, no patched versions exist.","status":"published","published":"2023-12-22T16:44:57.007Z","modified":"2026-10-28T02:31:05.855892373Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-89"],"updated_at":"2026-11-02T15:44:35.245372Z"},{"id":"DEBIAN-CVE-2023-51448","description":"Cacti provides an operational monitoring and fault management framework. Version 1.2.25 has a Blind SQL Injection (SQLi) vulnerability within the SNMP Notification Receivers feature in the file `‘managers.php’`. An authenticated attacker with the “Settings/Utilities” permission can send a crafted HTTP GET request to the endpoint `‘/cacti/managers.php’` with an SQLi payload in the `‘selected_graphs_array’` HTTP GET parameter. As of time of publication, no patched versions exist.","status":"published","published":"2023-12-22T17:15:09.96Z","modified":"2026-10-26T18:03:07.191800282Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:40.586408Z"},{"id":"UBUNTU-CVE-2023-51448","description":"Cacti provides an operational monitoring and fault management framework. Version 1.2.25 has a Blind SQL Injection (SQLi) vulnerability within the SNMP Notification Receivers feature in the file `‘managers.php’`. An authenticated attacker with the “Settings/Utilities” permission can send a crafted HTTP GET request to the endpoint `‘/cacti/managers.php’` with an SQLi payload in the `‘selected_graphs_array’` HTTP GET parameter. As of time of publication, no patched versions exist.","status":"published","published":"2023-12-22T17:15:00Z","modified":"2025-10-24T05:02:23Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"},{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T16:54:23.935133Z"},{"id":"openSUSE-SU-2024:0031-1","title":"Security update for cacti, cacti-spine","description":"This update for cacti, cacti-spine fixes the following issues:\n\ncacti-spine 1.2.26:\n\n* Fix: Errors when uptime OID is not present\n* Fix: MySQL reconnect option is depreciated\n* Fix: Spine does not check a host with no poller items\n* Fix: Poller may report the wrong number of devices polled\n* Feature: Allow users to override the threads setting at the command line\n* Feature: Allow spine to run in ping-only mode\n\ncacti 1.2.26:\n\n* CVE-2023-50250: XSS vulnerability when importing a template file (boo#1218380)\n* CVE-2023-49084: RCE vulnerability when managing links (boo#1218360)\n* CVE-2023-49085: SQL Injection vulnerability when managing poller devices (boo#1218378)\n* CVE-2023-49086: XSS vulnerability when adding new devices (boo#1218366)\n* CVE-2023-49088: XSS vulnerability when viewing data sources in debug mode (boo#1218379)\n* CVE-2023-51448: SQL Injection vulnerability when managing SNMP Notification Receivers (boo#1218381)\n* When viewing data sources, an undefined variable error may be seen\n* Improvements for Poller Last Run Date\n* Attempting to edit a Data Query that does not exist throws warnings and not an GUI error\n* Improve PHP 8.1 support when adding devices\n* Viewing Data Query Cache can cause errors to be logged\n* Preserve option is not properly honoured when removing devices at command line\n* Infinite recursion is possible during a database failure\n* Monitoring Host CPU's does not always work on Windows endpoints\n* Multi select drop down list box not rendered correctly in Chrome and Edge\n* Selective Plugin Debugging may not always work as intended\n* During upgrades, Plugins may be falsely reported as incompatible\n* Plugin management at command line does not work with multiple plugins\n* Improve PHP 8.1 support for incrementing only numbers\n* Allow the renaming of guest and template accounts\n* DS Stats issues warnings when the RRDfile has not been initialized\n* When upgrading, missing data source profile can cause errors to be logged\n* When deleting a single Data Source, purge historical debug data\n* Improvements to form element warnings\n* Some interface aliases do not appear correctly\n* Aggregate graph does not show other percentiles\n* Settings table updates for large values reverted by database repair\n* When obtaining graph records, error messages may be recorded\n* Unable to change a device's community at command line\n* Increase timeout for RRDChecker\n* When viewing a graph, option to edit template may lead to incorrect URL\n* When upgrading, failures may occur due to missing color table keys\n* On installation, allow a more appropriate template to be used as the default\n* When data input parameters are allowed to be null, allow null\n* CSV Exports may not always output data correctly\n* When debugging a graph, long CDEF's can cause undesirable scrolling\n* Secondary LDAP server not evaluated when the first one has failed\n* When adding a device, using the bulk walk option can make version information appear\n* When parsing a Data Query resource, an error can be reported if no direction is specified\n* Database reconnection can cause errors to be reported incorrectly\n* fix returned value if $sau is empty\n* Add Aruba switch, Aruba controller and HPE iLO templates\n* Add OSCX 6x00 templates\n","status":"published","published":"2024-01-24T12:47:05Z","modified":"2026-02-04T02:28:19.679293Z","updated_at":"2026-11-02T16:58:33.135986Z"},{"id":"openSUSE-SU-2024:13533-1","title":"cacti-1.2.26-1.1 on GA media","description":"These are all security issues fixed in the cacti-1.2.26-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:35:52.465734Z","updated_at":"2026-11-02T16:58:36.327643Z"}]}}