CVE-2024-31459

Name of the Vulnerable Software and Affected Versions Cacti versions prior to 1.2.27

Description Cacti provides an operational monitoring and fault management framework. There is a file inclusion issue in the lib/plugin.php file, specifically with the api plugin hook() function, which reads the plugin hooks and plugin config tables in the database. The read data is directly used to concatenate the file path, which is used for file inclusion. Combined with SQL injection vulnerabilities, remote code execution can be implemented.

Recommendations For versions prior to 1.2.27, update to version 1.2.27 or later, which contains a patch for the issue. As a temporary workaround, consider disabling the api plugin hook() function in the lib/plugin.php file until a patch is available. Restrict access to the lib/plugin.php file to minimize the risk of exploitation.