Cacti Cross-site Scripting vulnerability when managing trees

An attacker with high-level permissions logs into Cacti and navigates to Management > Devices to create a new device. In the "Description" and "Hostname" fields, a malicious XSS payload is entered and saved. The attacker then goes to Management > Trees, enters a tree name, and under "Available Sites" navigates through sub-tabs, which triggers the stored script. The payload executes in the browsers of users who access the affected tree management page, potentially leading to session hijacking or cookie theft [ref_id=1].

The advisory [ref_id=1] identifies that the vulnerability is triggered when managing trees in Cacti. Specifically, the "Description" and "Hostname" fields of a Device, and the "Tree Name" field, are not properly sanitized, allowing stored XSS payloads to be injected.

Version 1.2.27 contains a patch for the issue [ref_id=1]. The advisory recommends input sanitization and escaping to cleanse user inputs of malicious code, limiting the use of inline JavaScript, and ensuring proper output escaping for data retrieved from databases [ref_id=1]. No specific patch diff is provided in the bundle.