Description
SQL injection vulnerability in Cacti 0.8.6i and earlier, when register_argc_argv is enabled, allows remote attackers to execute arbitrary SQL commands via the (1) second or (2) third arguments to cmd.php. NOTE: this issue can be leveraged to execute arbitrary commands since the SQL query results are later used in the polling_items array and popen function.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | cacti | 0.8.6i-3 | — |
| Debian 13 | cacti | 0.8.6i-3 | — |
| Debian 12 | cacti | 0.8.6i-3 | — |
| Debian 3.1 | cacti | 0.8.6c-7sarge4 | DSA-1250-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | cacti | 1.2.18-1.2 | openSUSE-SU-2024:10670-1 |
Advisories 2
- DSA-1250-1 cacti Debian Security (DSA / DLA) · Mar 9, 2026
- openSUSE-SU-2024:10670-1 cacti-1.2.18-1.2 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
References
- DSA-1250 vendor-advisory
- OpenPKG-SA-2007.001 vendor-advisory
- 23917 third-party-advisory
- MDKSA-2007:015 vendor-advisory
- 23528 third-party-advisory
- 1017451 vdb-entry
- cacti-cmd-sql-injection(31177) vdb-entry
- GLSA-200701-23 vendor-advisory
- SUSE-SA:2007:007 vendor-advisory
- ADV-2006-5193 vdb-entry
- http://www.cacti.net/release_notes_0_8_6j.php
- 23665 third-party-advisory
- 3029 exploit
- 21799 vdb-entry
- 23941 third-party-advisory
- 20070118 Re: FW: [cacti-announce] Cacti 0.8.6j Released mailing-list