Cacti, an open source performance monitoring platform, was vulnerable in releases 1.2.30 and earlier to a pre‑authentication SQL injection. The flaw existed when the rfilter request variable was concatenated directly into a RLIKE SQL clause without sanitization, allowing an attacker to inject arbitrary SQL and manipulate the database. The injection could be used to exfiltrate data or modify configuration settings, and depending on the database back‑end and permissions, may lead to further system compromise. The weakness is represented by CWE‑89.

All installations running Cacti version 1.2.30 or earlier are affected. The issue is exploitable on environments where guest viewing of graphs is enabled because graph_view.php does not require authentication. Users should check their running version and ensure that guest access is disabled if they cannot upgrade immediately.

The CVSS score of 9.8 reflects a critical severity. Because the endpoint is reachable without authentication, the likelihood of exploitation is high in unprotected setups. The vulnerability is not listed in CISA’s KEV, and EPSS is not available, but the lack of authentication requirement and the severity indicate that attackers can easily discover and exploit the flaw. The exploit path requires only reading the graph_view.php URL, providing a rfilter parameter, and the vulnerability will allow arbitrary SQL execution.