Thomas Vincent

**Name of the Vulnerable Software and Affected Versions** Cacti versions prior to 1.2.31 **Description** An unauthenticated attacker can perform SQL injection on installations where guest graph viewing is enabled. The issue occurs because the `rfilter` request parameter is retrieved using the raw accessor `grv()` instead of `gfrv()` with `FILTER VALIDATE IS REGEX` validation. This parameter is then concatenated directly into RLIKE SQL clauses within `lib/html graph.php` and `lib/html tree.php`, which are accessible pre-authentication via the `graph view.php` endpoint. By using an unbalanced-quote payload to bypass regex validation, an attacker can inject arbitrary SQL to compromise the database's confidentiality, integrity, and availability. **Recommendations** Update to version 1.2.31. As a temporary mitigation, disable guest graph viewing to prevent unauthenticated access to the affected endpoint.