Cacti CVE-2025-24367 Authenticated RCE PoC

This repository contains a proof‑of‑concept exploit for CVE‑2025‑24367, an authenticated remote code execution vulnerability in Cacti.

The issue abuses insufficient input sanitization in graph template handling. By injecting malicious content into the “Unix – Logged in Users” graph template (ID 226), it is possible to write an arbitrary PHP file to the Cacti web root and execute commands on the server.

This PoC is intended for lab environments, controlled testing, and research purposes only.

---

Vulnerability Summary

• Product: Cacti
• Vulnerability: Authenticated Remote Code Execution
• CVE: CVE‑2025‑24367
• Attack Vector: Graph template injection (RRDTool command context)
• Authentication Required: Yes (valid Cacti user)

The vulnerability exists due to unsafe handling of user‑controlled input in graph template fields, which are passed to RRDTool without adequate sanitization.

---

Exploit Overview

The exploit works in two stages:

1. Payload upload A malicious graph template update causes Cacti to write a PHP file to disk, which downloads a bash reverse shell script from the attacker.

2. Payload execution The template is triggered again to execute the downloaded script, resulting in a reverse shell back to the attacker.

A temporary HTTP server is used to host the payload during exploitation.