CVE-2026-71287

Name of the Vulnerable Software and Affected Versions Cacti (affected versions not specified)

Description The sanitize sql column() function in lib/functions.php fails to properly sanitize user-supplied ORDER BY column names. The function uses a regular expression that allows letters, digits, underscores, parentheses, and dots, which enables payloads like SLEEP(5) to pass unmodified. This sanitized value is concatenated directly into raw SQL ORDER BY clauses via the sort column GET parameter in the endpoints 'user log.php', 'utilities.php', 'user domains.php', and 'user group admin.php'. Consequently, any authenticated user can perform time-based blind SQL injection, a technique used to extract information from a database by observing the time it takes for the server to respond to specific queries.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.