CVE-2024-54146

CVE-2024-54146 is a SQL injection vulnerability (CWE-89) affecting Cacti, an open-source performance and fault management framework. The flaw exists in the template function of the host_templates.php file, where the graph_template parameter is not properly sanitized, enabling injection attacks. Published on January 27, 2025, the vulnerability carries a CVSS v3.1 base score of 7.6 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H) and was addressed in Cacti version 1.2.29.

An attacker with low-privilege access, such as an authenticated user, can exploit this over the network with low complexity and no user interaction required. Exploitation allows limited impacts on confidentiality and integrity—potentially exposing or altering some data—but a high availability impact, such as denial-of-service through database disruption.

Mitigation is outlined in the Cacti GitHub security advisory (GHSA-vj9g-p7f2-4wqj) and the associated fix commit (c7e4ee798d263a3209ae6e7ba182c7b65284d8f0), which recommend upgrading to Cacti 1.2.29 or later to patch the SQL injection handling in host_templates.php.