Cacti SQL Injection vulnerability in lib/html_form_templates.php by reading dirty data stored in database

An attacker first submits a crafted POST request to `graph_template_inputs.php` with a malicious `column_name` value (e.g., `id FROM host AS gti;DELETE FROM sessions WHERE 1;#`). This dirty data is stored in the `graph_template_input` table. Subsequently, an administrator-level user triggers the vulnerable code path by accessing `graphs.php?action=graph_edit&id=1`, which calls `draw_nontemplated_fields_graph_item()` and concatenates the unsanitized `column_name` into an SQL query, executing the injected payload. [ref_id=1]

The vulnerability resides in the `form_save()` function in `graph_template_inputs.php` and the `draw_nontemplated_fields_graph_item()` function in `lib/html_form_templates.php`. The `column_name` field stored in the `graph_template_input` database table is not thoroughly sanitized before being concatenated into an SQL statement, leading to SQL injection.

The patch in version 1.2.27 adds proper input validation and sanitization for the `column_name` field before it is used in SQL concatenation. By ensuring that user-supplied data cannot contain SQL metacharacters or arbitrary SQL fragments, the fix prevents an attacker from injecting malicious SQL statements through the form template input mechanism. [ref_id=1]