Users can supply a value for the sort_column GET parameter that bypasses the server side filter and ends up being concatenated into a raw ORDER BY clause. The sanitizer permits letters, digits, underscore, parentheses and dots, which allows payloads such as SLEEP(5) to survive unchanged. Because ORDER BY clauses cannot be parameterized, an attacker can trigger prolonged responses that indicate whether a condition is true, enabling time‑based blind SQL injection. This flaw can be used to extract data from the Cacti database and could potentially support further attacks if the database contains sensitive configuration or user credentials.

The vulnerability exists in the Cacti application, specifically in the function sanitize_sql_column defined in lib/functions.php. Pages that process the sort_column parameter, such as user_log.php, utilities.php, user_domains.php, and user_group_admin.php, are affected. All versions of Cacti that use the current implementation of this function are vulnerable; version or patch information was not provided in the source data.

With a CVSS score of 8.8, the flaw is considered high severity. No EPSS score is available, and the vulnerability is not listed in the CISA KEV catalog, indicating that despite its severity it may not yet be actively exploited. The most likely attack vector is an authenticated user—any user with access to Cacti—submitting a crafted sort_column value to a vulnerable endpoint. The exploitation does not require special network access; it can occur over the web interface used by legitimate users.