CVE-2024-31458: 
Cacti vulnerability analysis and mitigation

Cacti, an operational monitoring and fault management framework, was found to contain a SQL injection vulnerability (CVE-2024-31458) prior to version 1.2.27. The vulnerability exists in the form_save() function in graph_template_inputs.php where data is not thoroughly checked and is used to concatenate SQL statements in the draw_nontemplated_fields_graph_item() function from lib/html_form_templates.php (GitHub Advisory).

The vulnerability stems from the column_name field in the graph_template_input SQL table, which is controllable through the form_save() function. While writing malicious data doesn't require administrator privileges, exploiting the vulnerability requires administrator access. The field length is limited to 50 characters. The attack vector involves the graph_edit() function in graphs.php, which calls draw_nontemplated_fields_graph_item(), where the $item variable is not properly sanitized before SQL concatenation. The vulnerability has been assigned a CVSS v3.1 base score of 4.6 (Medium) with vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:L (GitHub Advisory).

The successful exploitation of this vulnerability could allow an attacker to perform SQL injection attacks, potentially leading to unauthorized data manipulation or deletion in the database. For example, an attacker could manipulate session data or perform other database operations (GitHub Advisory).

The vulnerability requires administrator privileges to exploit, though writing malicious data does not require such privileges. A proof of concept exists that demonstrates how an attacker can manipulate the column_name field to execute arbitrary SQL commands, such as deleting session data (GitHub Advisory).

The vulnerability has been patched in Cacti version 1.2.27. Users are advised to upgrade to this version or later to address the security issue. The fix includes proper input validation and sanitization of the affected parameters (GitHub Advisory, Fedora Update).