Moritz Naumann has reported multiple vulnerabilities in Cacti, which can be exploited by malicious users to conduct script insertion attacks, and by malicious people to conduct cross-site scripting attacks.

1) Input passed via the "page_refresh", "default_dual_pane_width", "title_size", "legend_size", "axis_size" or "unit_size" parameter to graph_settings.php is not properly sanitised before being displayed to the user. This can be exploited to insert arbitrary HTML and script code, which will be executed in a user's browser session in context of an affected site.

Successful exploitation requires permissions to change graph settings.

2) Input passed to the "graph_end" parameter in graph.php (when "action" is set to "zoom" and "local_graph_id" is set) is not properly sanitised before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site.

3) Input passed to the "graph_start" parameter in graph.php (when "action" is set to "properties", "view_type" is set to "tree", and "local_graph_id" and"rra_id" are set) is not properly sanitised before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site.

4) Input passed via the "date1" parameter to graph_view.php (when "action" is set to "tree", "tree_id" is set to "1", "leaf_id" is set to "7" and "select_first" is set to "true") is not properly sanitised before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site.

The vulnerabilities are reported in version 0.8.7e. Other versions may also be affected.

Solution
Apply the patch:
Further details available to Secunia VIM customers

Provided and/or discovered by
Moritz Naumann

Changelog
Further details available to Secunia VIM customers

Original Advisory
Cacti:
http://docs.cacti.net/#cross-site_scripting_fixes

Moritz Naumann:
http://archives.neohapsis.com/archives/fulldisclosure/2009-11/0292.html

Deep Links
Links available to Secunia VIM customers