iDEFENSE Security Advisory 06.22.05-2 – Cacti contains an input validation error in the config_settings.php script which allows an attacker to include arbitrary PHP code from remote sites.
You can download this advisory from the following link: https://packetstormsecurity.com/files/download/38230/06.22.05-2.txt
Source: https://packetstormsecurity.com/files/38230/iDEFENSE-Security-Advisory-2005-06-22.2.html