CVE-2018-20726

An attacker with the ability to edit a Device's "Website Hostname" field can inject a JavaScript payload such as `<img src=xss onerror=alert(1)>` [ref_id=1]. When a victim visits `tree.php?action=edit&id=1`, the stored payload is rendered unsanitized in the Tree table, causing the script to execute in the victim's browser [ref_id=1]. No authentication bypass is needed — the attacker must have access to edit device settings.

The vulnerability exists in `host.php` (via `tree.php`) in Cacti before 1.2.0. The "Website Hostname" field for Devices is stored without escaping, and when rendered in the Tree table the value is printed directly without sanitization [ref_id=1].

The commit [ref_id=2] applies `html_escape()` to user-supplied values before they are output in HTML context. For example, `$name` is wrapped with `html_escape($name)` and `$value` is passed through `form_selectable_ecell()` (which escapes its content) instead of `form_selectable_cell()`. This ensures that any HTML or JavaScript embedded in the Hostname field is rendered as plain text, preventing XSS.

1. Navigate to `http://localhost:4040/cacti/host.php?action=edit&id=1` and set the Hostname field to `<img src=xss onerror=alert(1)>`. 2. Visit `http://localhost:4040/cacti/tree.php?action=edit&id=1` — the payload executes [ref_id=1].