Vulnerability record · CVE-2023-39361 · published 5 September 2023
CVE-2023-39361: Cacti graph_view.php SQL injection allows unauthenticated guest access
Cacti · Cacti
Cacti's graph_view.php is vulnerable to SQL injection. Guest users can reach graph_view.php without authentication by default, so when guest access is enabled the flaw is remotely exploitable without credentials. The vendor fixed it in version 1.2.25 and states there are no workarounds.
Description
Cacti is an open source operational monitoring and fault management framework. Affected versions are subject to a SQL injection discovered in graph_view.php. Since guest users can access graph_view.php without authentication by default, if guest users are being utilized in an enabled state, there could be the potential for significant damage. Attackers may exploit this vulnerability, and there may be possibilities for actions such as the usurpation of administrative privileges or remote code execution. This issue has been addressed in version 1.2.25. Users are advised to upgrade. There are no known workarounds for this vulnerability.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Automated analysis
critical priorityCVSS 9.8 with no authentication or user interaction required, very high EPSS, and vendor-tagged exploit material make this a top remediation priority.
What it is
Cacti's graph_view.php is vulnerable to SQL injection. Guest users can reach graph_view.php without authentication by default, so when guest access is enabled the flaw is remotely exploitable without credentials. The vendor fixed it in version 1.2.25 and states there are no workarounds.
Impact
An attacker can read and manipulate database contents, potentially usurping administrative privileges or achieving remote code execution as described in the advisory.
Attack surface
Reachable over the network through graph_view.php; the CVSS vector shows no privileges or user interaction required, and the description states guest users can access the page unauthenticated when guest access is enabled.
Exploitation
Not listed in CISA KEV, but EPSS is very high (0.88793, 99.8th percentile) and the vendor advisory is tagged Exploit, indicating public exploit material exists.
What to do
- Upgrade Cacti to version 1.2.25 or later; no workarounds are documented.
- Apply the Debian DSA-5550 and Fedora package updates for Cacti.
- Disable guest user access in Cacti if it is not operationally required.
- Restrict network access to the Cacti web interface to trusted management networks.
Detection
- Inspect web logs for requests to graph_view.php containing SQL metacharacters or unusual parameter values.
- Monitor Cacti database activity for anomalous queries or errors originating from the web front end.
- Alert on unexpected creation or modification of Cacti administrative accounts.
- Review Cacti application logs for errors tied to graph_view.php requests.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
2 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
Track CVE-2023-39361 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2023-39361), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
