CVE-2025-26520

Executive Summary

CVE-2025-26520 is a critical SQL injection vulnerability in Cacti, an open-source network monitoring and graphing tool. The flaw exists in the template function within host_templates.php, specifically through the graph_template parameter. This vulnerability is a direct result of an incomplete fix for CVE-2024-54146, meaning the original patch did not fully sanitize user input, leaving the application exposed to SQL injection attacks. An authenticated attacker with low privileges can exploit this to execute arbitrary SQL commands, potentially leading to data exfiltration, modification, or privilege escalation. The CVSS score of 7.6 (High) underscores the severity, though the EPSS score of 0.0% suggests low current exploitation activity. No public proof-of-concept (PoC) or exploit code is available at this time, but the risk remains significant due to the incomplete patch history.

Supply Chain & Package Security

Cacti is a PHP-based application distributed via its official website and GitHub repository. This vulnerability does not directly affect package managers like NPM, PyPI, Go, or Ruby. However, organizations using Cacti as part of their monitoring stack should treat this as a critical supply chain risk, as the software is often deployed in sensitive network environments. The lack of a complete patch means that any deployment of Cacti up to version 1.2.29 is vulnerable, and users must rely on manual mitigation until an official fix is released.

CVSS Breakdown & Threat Level

• CVSS Score: 7.6 (High)
• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): Low (L) – Attacker needs valid credentials.
• User Interaction (UI): None (N) – No user action needed.
• Scope (S): Unchanged (U) – Vulnerability does not affect other components.
• Confidentiality (C): High (H) – Full database read access possible.
• Integrity (I): High (H) – Data can be modified or deleted.
• Availability (A): None (N) – No direct impact on availability.

Threat Level: High. The vulnerability is easy to exploit, requires low privileges, and can lead to complete compromise of the Cacti database, which often contains sensitive network credentials and configuration data.

Deep Dive & Mechanics

The vulnerability resides in the template function of host_templates.php. The graph_template parameter is passed directly into an SQL query without proper sanitization or parameterization. The incomplete fix for CVE-2024-54146 likely addressed a similar injection point but missed this specific parameter, leaving it exploitable.

Root Cause: The application fails to use prepared statements or properly escape the graph_template input before concatenating it into an SQL query. An attacker can inject malicious SQL payloads via this parameter, such as:

' OR '1'='1' -- 

This can be used to bypass authentication, extract data, or execute arbitrary SQL commands.

Attack Flow:

1. Attacker authenticates to the Cacti web interface with low-privilege credentials.
2. Attacker crafts a malicious HTTP request to host_templates.php with a manipulated graph_template parameter.
3. The injected SQL is executed against the Cacti database (typically MySQL/MariaDB).
4. Attacker retrieves sensitive data (e.g., user hashes, device credentials) or modifies database entries.

Vulnerable vs. Patched Code

Vulnerable Code (Cacti <= 1.2.29):

// host_templates.php (simplified)
$graph_template = $_REQUEST['graph_template'];
$sql = "SELECT * FROM graph_templates WHERE id = '$graph_template'";
$result = db_fetch_assoc($sql);

Patched Code (Expected Fix):

// host_templates.php (patched)
$graph_template = $_REQUEST['graph_template'];
$sql = "SELECT * FROM graph_templates WHERE id = ?";
$result = db_fetch_assoc_prepared($sql, array($graph_template));

The patched version uses a prepared statement with a parameterized query, preventing SQL injection. The db_fetch_assoc_prepared function (or equivalent) should be used to bind the parameter safely.

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• Cacti instance (version <= 1.2.29) accessible over the network.
• Valid low-privilege user credentials (e.g., guest:guest).

Exploitation Steps:

1. Authenticate to the Cacti web interface.
2. Craft the SQL injection payload in the graph_template parameter. Example:

   http://target/cacti/host_templates.php?action=template&graph_template=1' UNION SELECT 1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51,52,53,54,55,56,57,58,59,60,61,62,63,64,65,66,67,68,69,70,71,72,73,74,75,76,77,78,79,80,81,82,83,84,85,86,87,88,89,90,91,92,93,94,95,96,97,98,99,100--
   

   Adjust the number of columns based on the target table structure.
3. Extract data using UNION-based SQL injection to dump the user_auth table:

   http://target/cacti/host_templates.php?action=template&graph_template=1' UNION SELECT 1,username,password,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51,52,53,54,55,56,57,58,59,60,61,62,63,64,65,66,67,68,69,70,71,72,73,74,75,76,77,78,79,80,81,82,83,84,85,86,87,88,89,90,91,92,93,94,95,96,97,98,99,100 FROM user_auth--
   

4. Escalate privileges by modifying the user_auth table to grant admin rights.

Note: No public exploit code is available; the above is a conceptual demonstration.

Blue Team (Defensive)

Detection & Response:

• Monitor HTTP requests to host_templates.php for abnormal graph_template parameters containing SQL keywords (e.g., UNION, SELECT, OR).
• Enable Web Application Firewall (WAF) rules to block SQL injection patterns.
• Review database logs for unexpected queries or errors originating from the Cacti application.
• Implement network segmentation to limit Cacti’s exposure to trusted networks only.

Honeypot Strategy:

• Deploy a decoy Cacti instance with fake credentials to lure attackers and log their activities.

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP requests to /cacti/host_templates.php with graph_template parameter containing SQL metacharacters (e.g., ', --, UNION).
  • Unusual database queries in MySQL logs from the Cacti user account.
• File IOCs:
  • Modified host_templates.php file (if attacker uploads a webshell).
  • Unexpected files in the Cacti webroot (e.g., shell.php).
• System IOCs:
  • New user accounts or privilege escalations in the Cacti database.
  • Outbound connections from the Cacti server to unknown IPs (data exfiltration).

Detection Engineering

YARA Rule

rule CVE_2025_26520_SQLi_Detection {
    meta:
        description = "Detects SQL injection attempts targeting CVE-2025-26520 in Cacti"
        author = "Valters IT"
        date = "2025-02-20"
        reference = "CVE-2025-26520"
    strings:
        $sqli1 = /graph_template=.*['\"]\s*(OR|AND|UNION|SELECT|INSERT|UPDATE|DELETE|DROP|--|#)/ nocase
        $sqli2 = /graph_template=.*\b(1=1|1=2|admin'|' OR '1'='1)\b/ nocase
    condition:
        any of them
}

Sigma Rule

title: Cacti SQL Injection via graph_template Parameter
id: 8a9b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects SQL injection attempts against Cacti host_templates.php via the graph_template parameter
author: Valters IT
date: 2025/02/20
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-uri-query|contains: 
            - 'host_templates.php'
            - 'graph_template='
    keywords:
        - "' OR '1'='1"
        - "UNION SELECT"
        - "1=1--"
        - "admin'--"
    condition: selection and keywords
falsepositives:
    - Legitimate use of special characters in graph template names (unlikely)
level: high

Suricata Rule

alert http $EXTERNAL_NET any -> $HOME_NET any (
    msg:"CVE-2025-26520 Cacti SQL Injection Attempt";
    flow:to_server,established;
    content:"/host_templates.php"; http_uri;
    content:"graph_template="; http_uri;
    pcre:"/graph_template=.*['\"]\s*(OR|AND|UNION|SELECT|INSERT|UPDATE|DELETE|DROP|--|#)/i";
    sid:1000001;
    rev:1;
    reference:cve,2025-26520;
    priority:1;
)

Remediation & Mitigation

Immediate Actions:

1. Apply the incomplete fix for CVE-2024-54146 if not already done, but note that this does not fully resolve CVE-2025-26520.
2. Manually patch host_templates.php by replacing direct SQL concatenation with prepared statements (see patched code example above).
3. Restrict access to the Cacti web interface using firewall rules or VPN.
4. Disable the template action in host_templates.php if not required, by commenting out the relevant code.

Long-term Measures:

• Upgrade Cacti to a patched version once released (monitor official Cacti GitHub for updates).
• Implement a Web Application Firewall (WAF) with SQL injection rules.
• Conduct regular code audits to identify similar injection points.
• Enforce least privilege for database accounts used by Cacti.

Workaround:

• If patching is not possible, use a reverse proxy (e.g., Nginx) to block requests containing SQL injection patterns in the graph_template parameter.

Valters IT
Securing Digital Frontiers