CVE-2023-49085: Cacti pollers.php SQL injection allows arbitrary SQL execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: high.

high priorityCVSS score of 8.8 and high EPSS probability indicate significant risk, though exploitation requires authentication and no KEV listing is present.

What it is

Cacti versions 1.2.25 and prior contain a SQL injection flaw in the pollers.php script. An authorized user can execute arbitrary SQL code through this script. The vulnerability is rated high severity (CVSS 8.8) and no patch was available at publication.

Impact

An attacker with valid credentials can execute arbitrary SQL queries against the Cacti database, potentially reading, modifying, or deleting sensitive monitoring data and configuration. This could lead to further compromise of the monitoring infrastructure.

Attack surface

The flaw is reachable over the network via the pollers.php script. Exploitation requires authentication with at least low privileges, as indicated by the CVSS vector (PR:L) and the description stating an authorized user is needed. No user interaction is required.

Exploitation

The vulnerability is not listed in CISA KEV, but EPSS indicates a high probability of exploitation (0.74276, 99.465th percentile). References include exploit and vendor advisory tags, suggesting public exploit code or detailed technical information is available.

What to do

• Apply the vendor patch as soon as it becomes available; monitor Cacti security advisories for updates.
• Restrict access to pollers.php to trusted networks or authenticated users only.
• Enforce least privilege for Cacti user accounts to limit the impact of SQL injection.
• Deploy a web application firewall (WAF) with rules to detect and block SQL injection attempts targeting pollers.php.
• Regularly review database logs for anomalous SQL queries originating from the Cacti application.

Detection

• Monitor web server logs for suspicious requests to pollers.php containing SQL keywords or unusual parameters.
• Enable database query logging and alert on unexpected SQL statements executed by the Cacti database user.
• Use intrusion detection systems (IDS) to detect SQL injection patterns in HTTP traffic to Cacti endpoints.
• Audit Cacti user accounts for unauthorized changes or privilege escalation attempts.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.