CVE-2026-39949

This repository is a small standalone Python proof-of-concept exploit for authenticated remote code execution in Cacti via host variable injection, identified as CVE-2026-39949. The repo contains only two files: a README describing the vulnerability and usage, and a single executable script, cacti_rce_poc.py, which is the main entry point. The exploit automates the full attack chain against a Cacti web application. It authenticates to the target using supplied credentials, retrieves CSRF tokens from Cacti forms, creates a new device/host with a malicious payload embedded in the notes field, creates a graph template whose right_axis_label references the |host_notes| variable, creates a graph using that template, and finally requests /graph_image.php to force graph rendering. The vulnerability is exploited because the host notes value is substituted into RRDtool command-line arguments without sanitization, allowing shell metacharacter injection. Capabilities include arbitrary command execution in direct mode and out-of-band verification/exfiltration in OOB mode. In direct mode, the script injects the operator-provided command, defaulting to `id`. In OOB mode, it builds a curl command that sends base64-encoded command output to an attacker-controlled HTTP endpoint. The payload is hardcoded shell command injection rather than a reusable framework payload, so the exploit is best classified as OPERATIONAL rather than weaponized. The code uses Python standard library modules only: argparse, urllib.request, urllib.parse, http.cookiejar, re, sys, and time. There is no external framework dependency. The main network interaction is with the target Cacti instance over HTTP(S), specifically the endpoints /index.php, /host.php, /graph_templates.php, /graphs_new.php, and /graph_image.php. The script also optionally causes the target to contact an attacker-controlled OOB domain over HTTP. Notable implementation details: session handling is done with a cookie jar; successful login is inferred by the presence of a cookie containing 'cacti'; CSRF tokens are extracted from HTML using a regex for __csrf_magic; created object IDs are parsed from redirect URLs or returned HTML. The exploit is clearly intended for real exploitation, not just detection, and there are no obvious signs of it being fake or destructive beyond the intended command execution behavior.