Description
SQL injection vulnerability in graph.php in Cacti before 0.8.7a allows remote attackers to execute arbitrary SQL commands via the local_graph_id parameter.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | cacti | 0.8.7a-1 | — |
| Debian 13 | cacti | 0.8.7a-1 | — |
| Debian 12 | cacti | 0.8.7a-1 | — |
| Debian 4.0 | cacti | 0.8.6i-3.2 | DSA-1418-1 |
| Debian 3.1 | cacti | 0.8.6c-7sarge5 | DSA-1418-1 |
Advisories 1
- DSA-1418-1 cacti - SQL injection Debian Security (DSA / DLA) · Mar 9, 2026
References
- http://bugs.gentoo.org/show_bug.cgi?id=199509
- ADV-2007-3911 vdb-entry
- cacti-graph-sql-injection(38559) vdb-entry
- 27756 third-party-advisory
- http://www.cacti.net/release_notes_0_8_7a.php
- DSA-1418 vendor-advisory
- 26487 vdb-entry
- FEDORA-2007-3683 vendor-advisory
- 27891 third-party-advisory
- GLSA-200712-02 vendor-advisory
- 27745 third-party-advisory
- 27719 third-party-advisory
- SUSE-SR:2007:024 vendor-advisory
- 27950 third-party-advisory
- 1018982 vdb-entry
- MDKSA-2007:231 vendor-advisory