CVE-2023-39361 Unauthenticated SQL Injection in graph_view.php in Cacti
Unauthenticated SQL injection in Cacti allows attackers to escalate privileges or execute code if guest access is enabled.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2023-39361?
CVE-2023-39361 is a critical SQL injection vulnerability in Cacti Cacti, published on 5 Sep 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Cacti is an open source operational monitoring and fault management framework. Affected versions are subject to a SQL injection discovered in graph_view.php. Since guest users can access graph_view.php without authentication by default, if guest users are being utilized in an enabled state, there could be the potential for significant damage. Attackers may exploit this vulnerability, and there may be possibilities for actions such as the usurpation of administrative privileges or remote code execution. This issue has been addressed in version 1.2.25. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Weakness: CWE-89
Which versions are affected by CVE-2023-39361?
It affects 2 products.
Products include Cacti Cacti, Fedoraproject Fedora.
How do I fix CVE-2023-39361?
Upgrade to a fixed version.
Use parameterised queries everywhere and never build SQL by joining strings. Upgrade affected software first; a web application firewall only buys time. More about SQL injection.
Is CVE-2023-39361 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2023-39361 exists.
Public exploit code: 1 Nuclei template and 3 proofs of concept on GitHub.
Other vulnerabilities in Cacti Cacti
- CVE-2022-46169 Cacti Command Injection
- CVE-2026-39893 Cacti: Pre-authentication SQL injection via rfilter RLIKE clause in graph_view.php
- CVE-2026-39938 Cacti: Unauthenticated RCE on Graph Image
- CVE-2026-39955 Cacti has Pre-Authentication SQL Injection via unanchored FILTER_VALIDATE_REGEXP in graph_view.php
- CVE-2022-0730 Auth bypass in Cati
Sources
Also known as CLEANSTART-2024-QJ84041, DEBIAN-CVE-2023-39361, GHSA-6r43-q2fw-5wrg, UBUNTU-CVE-2023-39361, USN-6720-1.