Reflected Cross-site Scripting in graphs_new.php in Cacti

An authenticated user can exploit this vulnerability by navigating to `graphs_new.php` with a crafted `returnto` parameter. The parameter must contain `javascript:` and `host.php` to bypass validation. For example, `http://IP/cacti/graphs_new.php?returnto=javascript:alert(location.hash.substring(1))//host.php#XSS` can be used. When the 'Cancel' button is clicked, the embedded JavaScript is executed within the user's browser context [ref_id=1].

The vulnerability resides in the `graphs_new.php` script, specifically where the `returnto` parameter is processed and passed to the `form_save_button` function. The `form_save_button` function then uses this parameter within an `onClick` attribute, which is vulnerable to injection if not properly escaped [ref_id=1].

The patch addresses the vulnerability by ensuring that the `returnto` parameter is properly validated and sanitized before being used. Specifically, the code now checks if the `returnto` parameter contains `host.php` and if not, it is set to an empty string, preventing the injection of malicious JavaScript. This ensures that the `returnto` parameter, when used in the `onClick` attribute, cannot be exploited to execute arbitrary scripts [ref_id=1].

Login to Cacti. Access to "http://IP/cacti/graphs_new.php?returnto=javascript:alert(location.hash.substring(1))//host.php#XSS" Click the Cancel button. [ref_id=1]