Fixes for:
CVE-2014-2326 Unspecified HTML Injection Vulnerability
CVE-2014-2328 Unspecified Remote Command Execution Vulnerability
CVE-2014-2708 Unspecified SQL Injection Vulnerability
CVE-2014-2709 Unspecified Remote Command Execution Vulnerability


(adam)

$NetBSD: patch-cdef.php,v 1.1 2014/08/23 12:50:25 adam Exp $

Fixes for:
CVE-2014-2326 Unspecified HTML Injection Vulnerability
CVE-2014-2328 Unspecified Remote Command Execution Vulnerability
CVE-2014-2708 Unspecified SQL Injection Vulnerability
CVE-2014-2709 Unspecified Remote Command Execution Vulnerability

--- cdef.php.orig	2013-08-06 22:31:19.000000000 -0400
+++ cdef.php		2014-04-04 21:39:04.000000000 -0400
@@ -431,7 +431,7 @@
 						<a class="linkEditMain" href="<?php print htmlspecialchars("cdef.php?action=item_edit&id=" . $cdef_item["id"] . "&cdef_id=" . $cdef["id"]);?>">Item #<?php print htmlspecialchars($i);?></a>
 					</td>
 					<td>
-						<em><?php $cdef_item_type = $cdef_item["type"]; print $cdef_item_types[$cdef_item_type];?></em>: <strong><?php print get_cdef_item_name($cdef_item["id"]);?></strong>
+						<em><?php $cdef_item_type = $cdef_item["type"]; print $cdef_item_types[$cdef_item_type];?></em>: <strong><?php print htmlspecialchars(get_cdef_item_name($cdef_item["id"]));?></strong>
 					</td>
 					<td>
 						<a href="<?php print htmlspecialchars("cdef.php?action=item_movedown&id=" . $cdef_item["id"] . "&cdef_id=" . $cdef["id"]);?>"><img src="images/move_down.gif" border="0" alt="Move Down"></a>
diff -ruBbd graph_xport.php graph_xport.php

$NetBSD: patch-graph_xport.php,v 1.1 2014/08/23 12:50:25 adam Exp $

Fixes for:
CVE-2014-2326 Unspecified HTML Injection Vulnerability
CVE-2014-2328 Unspecified Remote Command Execution Vulnerability
CVE-2014-2708 Unspecified SQL Injection Vulnerability
CVE-2014-2709 Unspecified Remote Command Execution Vulnerability

--- graph_xport.php.orig	2013-08-06 22:31:19.000000000 -0400
+++ graph_xport.php		2014-04-04 21:39:04.000000000 -0400
@@ -47,43 +47,48 @@
 
 $graph_data_array = array();
 
+/* ================= input validation ================= */
+input_validate_input_number(get_request_var("local_graph_id"));
+input_validate_input_number(get_request_var("rra_id"));
+/* ==================================================== */
+
 /* override: graph start time (unix time) */
-if (!empty($_GET["graph_start"]) && $_GET["graph_start"] < 1600000000) {
-	$graph_data_array["graph_start"] = $_GET["graph_start"];
+if (!empty($_GET["graph_start"]) && is_numeric($_GET["graph_start"] && $_GET["graph_start"] < 1600000000)) {
+	$graph_data_array["graph_start"] = get_request_var("graph_start");
 }
 
 /* override: graph end time (unix time) */
-if (!empty($_GET["graph_end"]) && $_GET["graph_end"] < 1600000000) {
-	$graph_data_array["graph_end"] = $_GET["graph_end"];
+if (!empty($_GET["graph_end"]) && is_numeric($_GET["graph_end"]) && $_GET["graph_end"] < 1600000000) {
+	$graph_data_array["graph_end"] = get_request_var("graph_end");
 }
 
 /* override: graph height (in pixels) */
-if (!empty($_GET["graph_height"]) && $_GET["graph_height"] < 3000) {
-	$graph_data_array["graph_height"] = $_GET["graph_height"];
+if (!empty($_GET["graph_height"]) && is_numeric($_GET["graph_height"]) && $_GET["graph_height"] < 3000) {
+	$graph_data_array["graph_height"] = get_request_var("graph_height");
 }
 
 /* override: graph width (in pixels) */
-if (!empty($_GET["graph_width"]) && $_GET["graph_width"] < 3000) {
-	$graph_data_array["graph_width"] = $_GET["graph_width"];
+if (!empty($_GET["graph_width"]) && is_numeric($_GET["graph_width"]) && $_GET["graph_width"] < 3000) {
+	$graph_data_array["graph_width"] = get_request_var("graph_width");
 }
 
 /* override: skip drawing the legend? */
 if (!empty($_GET["graph_nolegend"])) {
-	$graph_data_array["graph_nolegend"] = $_GET["graph_nolegend"];
+	$graph_data_array["graph_nolegend"] = get_request_var("graph_nolegend");
 }
 
 /* print RRDTool graph source? */
 if (!empty($_GET["show_source"])) {
-	$graph_data_array["print_source"] = $_GET["show_source"];
+	$graph_data_array["print_source"] = get_request_var("show_source");
 }
 
-$graph_info = db_fetch_row("SELECT * FROM graph_templates_graph WHERE local_graph_id='" . $_REQUEST["local_graph_id"] . "'");
+$graph_info = db_fetch_row("SELECT * FROM graph_templates_graph WHERE local_graph_id='" . get_request_var("local_graph_id") . "'");
 
 /* for bandwidth, NThPercentile */
 $xport_meta = array();
 
 /* Get graph export */
-$xport_array = @rrdtool_function_xport($_GET["local_graph_id"], $_GET["rra_id"], $graph_data_array, $xport_meta);
+$xport_array = @rrdtool_function_xport($_GET["local_graph_id"], get_request_var("rra_id"), $graph_data_array, $xport_meta);
 
 /* Make graph title the suggested file name */
 if (is_array($xport_array["meta"])) {

$NetBSD: patch-lib_graph_export.php,v 1.1 2014/08/23 12:50:25 adam Exp $

Fixes for:
CVE-2014-2326 Unspecified HTML Injection Vulnerability
CVE-2014-2328 Unspecified Remote Command Execution Vulnerability
CVE-2014-2708 Unspecified SQL Injection Vulnerability
CVE-2014-2709 Unspecified Remote Command Execution Vulnerability

--- lib/graph_export.php.orig	2013-08-06 22:31:19.000000000 -0400
+++ lib/graph_export.php	2014-04-04 21:39:05.000000000 -0400
@@ -339,7 +339,7 @@
 	chdir($stExportDir);
 
 	/* set the initial command structure */
-	$stExecute = 'ncftpput -R -V -r 1 -u '.$aFtpExport['username'].' -p '.$aFtpExport['password'];
+	$stExecute = 'ncftpput -R -V -r 1 -u ' . cacti_escapeshellarg($aFtpExport['username']) . ' -p ' . cacti_escapeshellarg($aFtpExport['password']);
 
 	/* if the user requested passive mode, use it */
 	if ($aFtpExport['passive']) {
@@ -347,7 +347,7 @@
 	}
 
 	/* setup the port, server, remote directory and all files */
-	$stExecute .= ' -P ' . $aFtpExport['port'] . ' ' . $aFtpExport['server'] . ' ' . $aFtpExport['remotedir'] . ".";
+	$stExecute .= ' -P ' . cacti_escapeshellarg($aFtpExport['port']) . ' ' . cacti_escapeshellarg($aFtpExport['server']) . ' ' . cacti_escapeshellarg($aFtpExport['remotedir']) . ".";
 
 	/* run the command */
 	$iExecuteReturns = 0;

$NetBSD: patch-lib_rrd.php,v 1.1 2014/08/23 12:50:25 adam Exp $

Fixes for:
CVE-2014-2326 Unspecified HTML Injection Vulnerability
CVE-2014-2328 Unspecified Remote Command Execution Vulnerability
CVE-2014-2708 Unspecified SQL Injection Vulnerability
CVE-2014-2709 Unspecified Remote Command Execution Vulnerability

--- lib/rrd.php.orig	2013-08-06 22:31:18.000000000 -0400
+++ lib/rrd.php		2014-04-04 21:39:04.000000000 -0400
@@ -865,13 +865,13 @@
 	/* basic graph options */
 	$graph_opts .=
 		"--imgformat=" . $image_types{$graph["image_format_id"]} . RRD_NL .
-		"--start=$graph_start" . RRD_NL .
-		"--end=$graph_end" . RRD_NL .
+		"--start=" . cacti_escapeshellarg($graph_start) . RRD_NL .
+		"--end=" . cacti_escapeshellarg($graph_end) . RRD_NL .
 		"--title=" . cacti_escapeshellarg($graph["title_cache"]) . RRD_NL .
 		"$rigid" .
-		"--base=" . $graph["base_value"] . RRD_NL .
-		"--height=$graph_height" . RRD_NL .
-		"--width=$graph_width" . RRD_NL .
+		"--base=" . cacti_escapeshellarg($graph["base_value"]) . RRD_NL .
+		"--height=" . cacti_escapeshellarg($graph_height) . RRD_NL .
+		"--width=" . cacti_escapeshellarg($graph_width) . RRD_NL .
 		"$scale" .
 		"$unit_value" .
 		"$unit_exponent_value" .
@@ -1606,8 +1606,8 @@
 
 	/* basic export options */
 	$xport_opts =
-		"--start=$xport_start" . RRD_NL .
-		"--end=$xport_end" . RRD_NL .
+		"--start=" . cacti_escapeshellarg($xport_start) . RRD_NL .
+		"--end=" . cacti_escapeshellarg($xport_end) . RRD_NL .
 		"--maxrows=10000" . RRD_NL;
 
 	$xport_defs = "";
@@ -1997,7 +1997,7 @@
 			$stacked_columns["col" . $j] = ($graph_item_types{$xport_item["graph_type_id"]} == "STACK") ? 1 : 0;
 			$j++;
 
-			$txt_xport_items .= "XPORT:" . $data_source_name . ":" . str_replace(":", "", cacti_escapeshellarg($legend_name)) ;
+			$txt_xport_items .= "XPORT:" . cacti_escapeshellarg($data_source_name) . ":" . str_replace(":", "", cacti_escapeshellarg($legend_name)) ;
 		}else{
 			$need_rrd_nl = FALSE;
 		}