Rapid7

module

Cacti Graph Template authenticated RCE versions prior to 1.2.29

Try Surface Command
Back to search
Disclosed
Jan 27, 2025
Created
Jan 23, 2026

Description

This module exploits an authenticated remote code execution vulnerability in Cacti versions prior to 1.2.29.
Authenticated users can upload a graph template through the /graph_templates.php endpoint. The right_axis_label
parameter is vulnerable to code injection, allowing attackers to execute arbitrary commands on the server.
The payload is length limited, due to this constraint the module starts an HTTP server and hosts the payload.
The initial payload downloads the full payload using curl from the attacker's server and saves it to the
web root of the cacti server before executing.

Authors

chutchut
Jack Heysel

Platform

Linux,PHP,Unix,Windows

Architectures

cmd, php

References

Module Options

To display the available options, load the module within the Metasploit console and run the commands 'show options' or 'show advanced':


    msf > use exploit/multi/http/cacti_graph_template_rce
    msf exploit(cacti_graph_template_rce) > show targets
        ...targets...
    msf exploit(cacti_graph_template_rce) > set TARGET < target-id >
    msf exploit(cacti_graph_template_rce) > show options
        ...show and set options...
    msf exploit(cacti_graph_template_rce) > exploit
Title
Rapid7 Labs

2026 Global Threat Landscape Report

The predictive window has collapsed. Exploitation follows disclosure in days. See how attackers are accelerating and how to stay ahead.

Get report