CVE-2014-2708 in Cacti
Summary
by MITRE
Multiple SQL injection vulnerabilities in graph_xport.php in Cacti 0.8.7g, 0.8.8b, and earlier allow remote attackers to execute arbitrary SQL commands via the (1) graph_start, (2) graph_end, (3) graph_height, (4) graph_width, (5) graph_nolegend, (6) print_source, (7) local_graph_id, or (8) rra_id parameter.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 05/10/2026
The CVE-2014-2708 vulnerability represents a critical sql injection flaw discovered in the graph_xport.php component of Cacti version 0.8.8b, a widely deployed network monitoring and graphing solution. This vulnerability resides within the data export functionality that allows users to export graph data in various formats, making it a prime target for malicious actors seeking to compromise network monitoring systems. The vulnerability affects the graph_xport.php file which handles the export of graph data, specifically when processing user-supplied parameters that are not properly sanitized or validated before being incorporated into sql queries. The unspecified vectors suggest that multiple input points within this export function could potentially be exploited, making the attack surface broader than initially apparent.
The technical exploitation of this vulnerability occurs when an attacker crafts malicious input parameters that are directly incorporated into sql statements without proper sanitization or parameterization. This allows attackers to inject arbitrary sql commands that execute within the context of the database connection used by Cacti, potentially enabling full database access, data exfiltration, or even system compromise. The flaw operates under the common principles of sql injection as classified by CWE-89, where insufficient input validation and sanitization creates opportunities for attackers to manipulate database queries. The vulnerability is particularly dangerous in network monitoring environments where Cacti systems often contain sensitive network topology data, user credentials, and performance metrics that could be leveraged for further attacks.
The operational impact of CVE-2014-2708 extends beyond simple data compromise, as network monitoring systems like Cacti serve as critical infrastructure components that provide visibility into network operations. When compromised, attackers can manipulate or extract monitoring data, potentially leading to undetected network intrusions or disruption of critical monitoring services. The vulnerability also aligns with ATT&CK technique T1071.004 for application layer protocol manipulation and T1046 for network service scanning, as attackers may use this vulnerability to explore network configurations and identify additional targets. Organizations relying on Cacti for network monitoring face significant risk of data breaches, service disruption, and potential lateral movement within their networks, especially when the monitoring system contains sensitive operational data.
Mitigation strategies for CVE-2014-2708 should prioritize immediate patching of affected Cacti installations to version 0.8.8c or later, which contains the necessary fixes for the sql injection vulnerability. Network segmentation and access controls should be implemented to limit exposure of the affected system, particularly restricting direct internet access to the Cacti web interface. Input validation and parameterized queries should be enforced throughout the application, with regular security code reviews to identify similar vulnerabilities in other components. Organizations should also implement database activity monitoring and intrusion detection systems to detect potential exploitation attempts. The vulnerability demonstrates the importance of maintaining up-to-date software versions and implementing proper input sanitization practices as outlined in OWASP top ten security principles. Additionally, regular vulnerability assessments and penetration testing should be conducted to identify and remediate similar sql injection vulnerabilities in other network monitoring and management systems.