The sanitize_sql_column() function in Cacti's lib/functions.php attempts to sanitize ORDER BY column names using a regex that removes characters except letters, digits, underscore, parentheses, and dot. This allowlist unintentionally permits SQL expressions such as SLEEP(5) to pass through unaltered. The sanitized input is directly concatenated into raw SQL ORDER BY clauses in user_log.php, utilities.php, user_domains.php, and user_group_admin.php. Since ORDER BY clauses cannot be parameterized, this leads to a time-based blind SQL injection vulnerability exploitable by any authenticated user regardless of privilege level.

An attacker with any authenticated access to Cacti can exploit this vulnerability to perform time-based blind SQL injection against the Cacti database. This can lead to unauthorized data disclosure, data modification, or denial of service. The vulnerability has a high CVSS score of 8.8, indicating significant confidentiality, integrity, and availability impacts.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict authenticated user access to trusted users only and monitor for suspicious activity related to SQL injection attempts in the affected endpoints. Avoid relying on the sanitize_sql_column() function for sanitizing ORDER BY inputs.