Vulnerability record · CVE-2023-51448 · published 22 December 2023
CVE-2023-51448: Cacti SNMP Notification Receivers blind SQL injection in managers.php
Cacti · Cacti
Cacti 1.2.25 contains a blind SQL injection in the SNMP Notification Receivers feature in managers.php. An authenticated user holding the Settings/Utilities permission can inject SQL through the selected_graphs_array GET parameter. No patched version existed at publication, so exposed instances remain vulnerable.
Description
Cacti provides an operational monitoring and fault management framework. Version 1.2.25 has a Blind SQL Injection (SQLi) vulnerability within the SNMP Notification Receivers feature in the file `‘managers.php’`. An authenticated attacker with the “Settings/Utilities” permission can send a crafted HTTP GET request to the endpoint `‘/cacti/managers.php’` with an SQLi payload in the `‘selected_graphs_array’` HTTP GET parameter. As of time of publication, no patched versions exist.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Automated analysis
high priorityCVSS 8.8 with high confidentiality, integrity and availability impact plus a very high EPSS score, though exploitation requires an authenticated privileged account.
What it is
Cacti 1.2.25 contains a blind SQL injection in the SNMP Notification Receivers feature in managers.php. An authenticated user holding the Settings/Utilities permission can inject SQL through the selected_graphs_array GET parameter. No patched version existed at publication, so exposed instances remain vulnerable.
Impact
An attacker with the required permission can read and manipulate the Cacti database, potentially exposing monitoring credentials and configuration, and with high integrity and availability impact could alter or destroy stored data.
Attack surface
Reached remotely over HTTP via a crafted GET request to /cacti/managers.php; authentication is required and the account must have the Settings/Utilities permission, and no user interaction is needed.
Exploitation
Not listed in CISA KEV, but EPSS is 0.67338 (99.27th percentile) and vendor advisory and code references are tagged Exploit, indicating public exploit material exists.
What to do
- Apply the vendor fix or upgrade once a patched Cacti release is available; no patched version existed at publication, so track the GHSA-w85f-7c4w-7594 advisory.
- Restrict the Settings/Utilities permission to the smallest possible set of trusted accounts and review existing assignments.
- Place the Cacti web interface behind authentication-aware access controls and limit exposure to trusted networks or a VPN.
- Monitor the Fedora package announcement for updated builds if Cacti is installed from distribution packages.
Detection
- Inspect web logs for GET requests to /cacti/managers.php where selected_graphs_array contains SQL syntax such as quotes, UNION, SLEEP, or comment markers.
- Alert on managers.php access from accounts or source IPs that do not normally use Settings/Utilities functions.
- Baseline and review database query errors or unusual query latency originating from the Cacti web tier.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
Track CVE-2023-51448 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2023-51448), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
