Cacti XSS vulnerability in lib/html.php by reading dirty data stored in database

An attacker with administrator privileges first submits a crafted `name` parameter containing a JavaScript payload (e.g. `<script>alert(1);</script>`) via a POST to `automation_tree_rules.php` with `action=save`. The payload is stored in the `automation_tree_rules` database table. Subsequently, the attacker triggers a GET request to `automation_tree_rules.php?action=remove&id=4`, which reads the stored payload and passes it unsanitized into `form_confirm()`, causing the script to execute in the victim's browser. [ref_id=1]

The vulnerability resides in `automation_tree_rules_form_save()` in `automation_tree_rules.php`, where the `name` field is stored without thorough sanitization. The unsanitized value is later read by `automation_tree_rules_remove()` and passed to `form_confirm()` in `lib/html.php`, where it is concatenated directly into HTML output, enabling stored cross-site scripting.

The patch in version 1.2.27 adds proper sanitization or escaping of the `name` field before it is concatenated into HTML output in `form_confirm()`. By ensuring that user-controllable data is escaped, the fix prevents the injection of arbitrary JavaScript, closing the stored cross-site scripting vector. [ref_id=1]

Send a POST to `automation_tree_rules.php` with `save_component_automation_graph_rule=1`, `action=save`, `id=4`, and `name=<script>alert(1);</script>`. Then send a GET to `automation_tree_rules.php?action=remove&id=4`. The injected script executes when the confirmation page renders. [ref_id=1]