Cacti versions 1.2.30 and earlier allow an unauthenticated SQL injection attack through the rfilter request parameter. The parameter is read via a raw accessor and inserted directly into RLIKE clauses in lib/html_graph.php and lib/html_tree.php. By crafting an unbalanced-quote payload that bypasses the intended regex validation, an attacker can inject arbitrary SQL to compromise the confidentiality, integrity, and availability of the database.

The vulnerability affects the open source performance and fault management framework Cacti, specifically any installation running version 1.2.30 or earlier. The affected files are accessed through graph_view.php when guest graph viewing is enabled.

The CVSS score of 9.3 indicates a high‑severity risk. The vulnerability can be exploited without authentication on systems that permit guest graph viewing, meaning an external attacker can reach the vulnerable endpoints over the network. While the EPSS score is not available and the issue is not listed in CISA’s KEV catalog, the combination of an unfiltered input, public reachability, and critical database impact make the exploit probability high for exposed deployments.