Cacti's sanitize_sql_column() (lib/functions.php) sanitizes user-supplied ORDER BY column names using the regex `preg_replace('/[^a-zA-Z0-9_().]/', '', $column)…

A SQL injection vulnerability exists in Cacti's sanitize_sql_column() function in lib/functions.php. The function uses a regex allowlist that permits letters, digits, underscores, parentheses, and dots, which inadvertently allows SQL function calls like SLEEP(5) to pass through unmodified. The sanitized value is directly concatenated into raw SQL ORDER BY clauses, which cannot be parameterized. The vulnerability is triggered via the sort_column GET parameter in at least four PHP files: user_log.php, utilities.php, user_domains.php, and user_group_admin.php. Any authenticated Cacti user, regardless of privilege level, can exploit this flaw to perform time-based blind SQL injection against the Cacti database. This represents a significant risk as it requires only valid authentication and no elevated privileges to exploit.