Sanitize_sql_column() in Cacti's lib/functions.php attempts to filter user-supplied ORDER BY column names using a regular expression that permits letters, digits, underscores, parentheses, and dots; this syntax is intended to support expressions such as COUNT(id) and table.column, but the permissive allowlist also accommodates function calls like SLEEP(5) or BENCHMARK(20). When a GET parameter named sort_column is supplied, the unsanitized value is concatenated directly into an ORDER BY clause that cannot be parameterized, giving an attacker a potential time-based blind SQL injection vector that can be used to infer data from the database.

The vulnerability exists in the Cacti application, specifically in the function sanitize_sql_column defined in lib/functions.php. Pages that process the sort_column parameter, such as user_log.php, utilities.php, user_domains.php, and user_group_admin.php, are affected. All versions of Cacti that use the current implementation of this function are vulnerable; version or patch information was not provided in the source data.

With a CVSS score of 8.8, the flaw is considered high severity. An EPSS score of < 1% indicates a very low probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog, suggesting that despite its severity it may not yet be actively exploited. The most likely attack vector is an authenticated user—any user with access to Cacti—submitting a crafted sort_column value to a vulnerable endpoint. The exploitation does not require special network access; it can occur over the web interface used by legitimate users.