CVE-2025-24368
- Source
- https://nvd.nist.gov/vuln/detail/CVE-2025-24368
- Import Source
- https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2025-24368.json
- JSON Data
- https://api.test.osv.dev/v1/vulns/CVE-2025-24368
- Aliases
-
- GHSA-f9c7-7rc3-574c
- Downstream
- Published
- 2025-01-27T17:16:17.236Z
- Modified
- 2025-11-28T02:34:29.095657Z
- Severity
-
- 6.9 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N CVSS Calculator
- Summary
- Cacti has a SQL Injection vulnerability when using tree rules through Automation API
- Details
-
Cacti is an open source performance and fault management framework. Some of the data stored in automationtreerules.php is not thoroughly checked and is used to concatenate the SQL statement in buildruleitemfilter() function from lib/apiautomation.php, resulting in SQL injection. This vulnerability is fixed in 1.2.29.
- Database specific
{ "cna_assigner": "GitHub_M", "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/24xxx/CVE-2025-24368.json", "cwe_ids": [ "CWE-89" ] }- References
-
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/24xxx/CVE-2025-24368.json
- https://github.com/Cacti/cacti/commit/c7e4ee798d263a3209ae6e7ba182c7b65284d8f0
- https://github.com/Cacti/cacti/security/advisories/GHSA-f9c7-7rc3-574c
- https://lists.debian.org/debian-lts-announce/2025/02/msg00010.html
- https://nvd.nist.gov/vuln/detail/CVE-2025-24368