Cacti's sanitize_sql_column() function improperly sanitizes user input for ORDER BY column names, allowing time-based blind SQL injection via the sort_column GET parameter. The sanitization regex permits characters that enable payloads such as SLEEP(5) to bypass filtering. This vulnerability affects multiple PHP files and can be exploited by any authenticated user regardless of privilege level. The CVSS score is 8.8, indicating high severity.