Insecure Deserialization in Cacti

An authenticated user can trigger this vulnerability by sending a POST request to `graphs_new.php` with `action=save` and `save_component_new_graphs` parameters, or to `managers.php` with `action=actions` and `action_receiver_notifications` parameters. In both cases, the user can control the `selected_graphs_array` or `selected_items` POST variable, which is then deserialized without proper sanitization [ref_id=1]. This allows an attacker to inject arbitrary PHP objects into the application's memory.

The vulnerable code resides in `graphs_new.php` within the `host_new_graphs_save` function, and in `managers.php` within the `form_actions` function. Both functions directly call `unserialize` on user-controlled input without adequate sanitization [ref_id=1].

The advisory states that the issue has been addressed in version 1.2.25. The fix involves ensuring that user input is properly sanitized before being passed to the `unserialize` function, or by utilizing Cacti's existing "safe" deserialization mechanism which includes content sanitization and value checks [ref_id=1]. Users are advised to upgrade to version 1.2.25 to mitigate this vulnerability.