The vulnerability allows an authenticated user with Automation realm privileges to store arbitrary SQL fragments in the automation_tree_rule_items.field column. When an administrator later triggers automation, the stored fragment is directly concatenated into a SELECT query, executed, and the resulting data is written into graph_tree_items.title. This value is rendered in the Cacti tree UI, providing attackers a channel to exfiltrate sensitive database information. The injection requires authentication but does not provide arbitrary code execution; impact is limited to data disclosure through the UI.

Cacti, the open‑source performance and fault management framework, is affected in all releases from 1.2.27 up to, but not including, 1.2.31. The issue is resolved in version 1.2.31 and later.

The CVSS score of 5.5 indicates moderate severity. EPSS data are not available, and the vulnerability is not listed in the CISA KEV catalog. The attack vector depends on possessing an authenticated account with the Automation realm, a role typically reserved for administrators. If such an account is compromised or misused, the attacker could extract database information via the UI by creating malicious automation rules and then triggering them through the bulk action interface. Exploitation therefore requires both administrative privileges and an active or scheduled automation run, limiting the overall likelihood to environments with permissive role assignments.