Summary

The Yokai research team, from Hakai Security, identified a SQL Injection vulnerability in Cacti versions <= 1.2.30. The flaw allows an authenticated user with SNMP management permissions to execute arbitrary SQL queries, enabling the reading or modification of the entire database content. The vulnerability resides in the managers.php file, where user input is inserted directly into SQL queries without type validation. Exploitation requires an authenticated account with agent privileges. Once exploited, an attacker can extract the complete contents of the database through SQL injection, including credential hashes, SNMP community strings, and infrastructure data. Following the report and coordinated alignment through the GitHub Security Advisory program, the Cacti team published the fix patch and the flaw received the identifier CVE-2026-40083. This publication aims to provide security researchers and defense professionals with a detailed analysis of the vulnerability, including its root cause, potential impact, and practical mitigation strategies for organizations.

Impact

The vulnerability allows authenticated users with SNMP Manager permissions to execute arbitrary queries on the database. This enables the reading of tables containing user data, configurations, device credentials, and SNMP communities, as well as the extraction of bcrypt hashes and API tokens, which can result in account compromise. Additionally, the flaw allows the execution of time-delay commands, potentially causing a denial of service due to the exhaustion of simultaneous connections to the database. According to data from TheirStack, Cacti is used by over 2,000 companies worldwide, amplifying the potential impact of this vulnerability in corporate environments.

Technical Details

The vulnerability exploits the lack of strict data type validation and the complete absence of parameterized queries in the SNMP management functionality. While most of the application uses correct abstractions, the logic responsible for processing directly interpolates the values extracted from an array to compose dynamic SQL code. The flaw is located within the repository in the managers.php file, specifically between lines 756 and 766, available in the historical view through the link https://github.com/Cacti/cacti/blob/release/1.2.30/managers.php#L756-L766.

$selected_items = cacti_unserialize(stripslashes(gnrv('selected_graphs_array')));

if (cacti_sizeof($selected_items)) {

    db_execute('DELETE FROM snmpagent_managers WHERE id IN (' . implode(',', $selected_items) . ')');

}

The manipulated field in the "selected_items" variable comes from the deserialization of user-controlled data sent in the request body. Although the application uses the cacti_unserialize function to mitigate vulnerabilities related to PHP Object Injection, preventing the deserialization of arbitrary classes, there are no adequate validations to restrict the manipulation of primitive types. As a consequence, an array containing user-controlled values can reach the SQL query concatenation stage, allowing the execution of arbitrary SQL queries.

Affected Endpoints

The affected endpoint corresponds to the administrative functionality "/cacti/managers.php", accessible through HTTP POST requests. It was observed that the "selected_graphs_array" parameter processed user-controlled data insecurely, becoming the injection point of the vulnerability. The payload was inserted into this field using a specially crafted serialized structure to manipulate the SQL query executed by the application.

For the validation of the vulnerability, a payload based on Time-Based Blind SQL Injection was used, which employs database delay functions, such as SLEEP(), to trigger a response with a high execution time when the SQL statement is successfully interpreted. The occurrence of this delay confirmed that the content provided in "selected_graphs_array" was incorporated into the SQL query without proper sanitization or parameterization, allowing the execution of arbitrary SQL statements. The HTTP request below demonstrates the proof of concept used during the tests, sent through the Burp Suite tool.

After sending the request, the application processes the injected content and forwards the query to the database. Since the user-controlled input is incorporated into the SQL statement without proper validation, the delay expression is executed by the database, causing a noticeable increase in the application's response time. This behavior confirms the exploitation of the vulnerability and demonstrates that the query can be manipulated through the vulnerable parameter.

Proof of Concept

Based on the identified vulnerability, a Python script was developed to automate the exploitation of this flaw: https://github.com/hakaioffsec/CVE-2026-40083.

Fix

The team responsible for Cacti fixed this vulnerability in version 1.2.31 through changes in the processing of user-provided data. The fix included strengthening input validations, reviewing the deserialization logic, and adapting the handling of arrays used during request processing, eliminating the scenario that allowed the manipulation of the SQL query. Below is the official diff containing the main changes implemented by the developers in the layer responsible for managing the affected functionality.

- $selected_items = cacti_unserialize(stripslashes(gnrv('selected_graphs_array')));
- if (cacti_sizeof($selected_items)) {
-     db_execute('DELETE FROM snmpagent_managers WHERE id IN (' . implode(',', $selected_items) . ')');
- }
+ $selected_items = sanitize_unserialize_selected_items(gnrv('selected_graphs_array'));
+ if (cacti_sizeof($selected_items)) {
+     $sanitized_items = array_map('intval', $selected_items);
+     db_execute('DELETE FROM snmpagent_managers WHERE id IN (' . implode(',', $sanitized_items) . ')');
+ }

The fix implements a layered approach to mitigate the vulnerability. Initially, the deserialized data passes through the sanitize_unserialize_selected_items() routine, which is responsible for validating the expected input structure. Then, all elements of the array are explicitly converted to the integer type using the array_map('intval', …) function, ensuring that only numeric values are used in the construction of the SQL query. This way, any attempt to insert SQL expressions or malicious characters is automatically converted into an integer value, preventing the user-controlled content from altering the structure of the SQL statement and eliminating the vulnerability's exploitation vector.

Recommendations

It is recommended to update Cacti to version 1.2.31 or higher, which fixes the vulnerability through proper validation of deserialized data and the explicit conversion of identifiers to integer values before the construction of the SQL query. Finally, it is recommended to restrict access to the application's administrative functionalities only to authorized users, applying the principle of least privilege and reducing the platform's attack surface.

Conclusão

Exploitation of this vulnerability allows an authenticated attacker with agent privileges in Cacti to abuse an inconsistency in array processing to perform SQL injection, enabling full extraction of the application's database contents, including credential hashes, SNMP community strings, and monitored infrastructure information.

Let's practice!

Hacking Club is a training platform focused on the practical development of cybersecurity professionals. The Cactus challenge replicates, in a controlled environment, a service vulnerable to the flaw discussed in this article, allowing researchers and professionals to consolidate the presented concepts by exploiting the vulnerability in a secure lab.

Referências

Official GitHub Security Advisory: GHSA-j9jv-6xjq-9hhj

Legacy Vulnerable Commit: 756-766

Central Reporter Identification: CVE-2026-40083

PoC Developed by Hakai Security: CVE-2026-40083