CVE-2020-14295: Cacti color.php SQL injection leads to command execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: high.

high priorityThe flaw enables remote code execution but requires an existing admin account, and public exploit code plus a very high EPSS score make it a realistic target for post-compromise or insider abuse.

What it is

Cacti 1.2.12 contains a SQL injection flaw in color.php where the filter parameter is not properly sanitized. Because the underlying database accepts stacked queries, an authenticated administrator can chain arbitrary SQL with operating system commands, turning a database injection into remote code execution. The issue matters because it converts a high-privilege web interface into full command execution on the Cacti host.

Impact

An attacker with admin access gains the ability to execute arbitrary SQL and, via stacked queries, run operating system commands on the server. This yields full compromise of the Cacti host and any data or credentials it holds.

Attack surface

The flaw is reached over the network through the color.php endpoint using the filter parameter, per the CVSS vector AV:N. Exploitation requires high privileges (PR:H) and no user interaction (UI:N), so an attacker must already hold a Cacti administrator account.

Exploitation

CVE-2020-14295 is not listed in CISA KEV, but public exploit code exists per Packetstorm and GitHub references tagged Exploit. EPSS is very high at 0.8633 (99.7th percentile), indicating strong likelihood of exploitation activity.

What to do

• Upgrade Cacti to a version later than 1.2.12 that fixes the color.php filter parameter handling.
• Apply the vendor or distribution patches referenced in the Fedora, openSUSE and Gentoo advisories if immediate upgrade is not possible.
• Restrict Cacti administrative access to trusted networks and enforce strong unique credentials, since exploitation requires an admin account.
• Audit and reduce the number of accounts with administrative privileges in Cacti.
• Monitor Cacti database and web logs for anomalous SQL or command patterns originating from color.php.

Detection

• Search web server logs for requests to color.php with unusual or SQL-like filter parameter values.
• Monitor database logs for stacked or multi-statement queries originating from the Cacti application.
• Alert on unexpected child processes spawned by the web server or database service on Cacti hosts.
• Review Cacti admin account activity for logins or actions outside normal patterns.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.