CVE-2026-71287
Description
Cacti's sanitize_sql_column (lib/functions.php) sanitizes user-supplied ORDER BY column names using the regex . Because this allowlist retains letters, digits, underscore, parentheses, and dot (intended to support expressions like COUNT(id) and table.column), a payload such as passes through completely unmodified.
Summary dbcve.org
Cacti's sanitize_sql_column function in lib/functions.php uses an overly permissive allowlist regex to sanitize ORDER BY column names, retaining letters, digits, underscores, parentheses, and dots. This allows SQL injection payloads to pass through unmodified, enabling attackers to manipulate SQL queries via the ORDER BY parameter.
Mitigation
Tighten the allowlist regex in sanitize_sql_column to restrict special characters, or implement additional input validation/sanitization layers to prevent SQL injection while preserving support for legitimate expressions.