Summary

Some of the data stored in form_save() function in data_queries.php is not thoroughly checked and is used to concatenate the HTML statement in grow_right_pane_tree() function from lib/html.php , finally resulting in XSS.

Details

In the SQL table snmp_query stored in database, the name field is controllable. The writing of dirty data can be done from form_save() function in data_queries.php.

Both writing and reading don't require administrator privileges, so the impact of this XSS vulnerability is relatively significant.
Writing: section13 from data_queries.php: template editor - data queries

Reading: section7 from graph_view.php : normal user - graph

The attack starts in graph_view.php. and calls form_confirm() function.

Finally arriving at lib/html_tree.php and reading field name in snmp_query. Variable $host_group_data_name is not checked and concatenated directly, resulting in XSS.

PoC

POST access data_queries.php and submit the following data：

            'id'=>'2',
            'action'=>'save',
            'save_component_snmp_query'=>1,
            'name'=>"dp:<script>alert(1);</script>",
            'description'=>"control",
            'xml_path'=>"control",
            'data_input_id'=>'1',

check field in snmp_query table.

GET access : "http://ip:port/graph_view.php?action=tree_content&node=test-1-tbranch&hgd=dq:2".

Researcher: ISHGARD-2, USTC