Debian Linux Security Advisory 2060-1 – Stefan Esser discovered that cacti, a front-end to rrdtool for monitoring systems and services, is not properly validating input passed to the rra_id parameter of the graph.php script. Due to checking the input of $_REQUEST but using $_GET input in a query an unauthenticated attacker is able to perform SQL injections via a crafted rra_id $_GET value and an additional valid rra_id $_POST or $_COOKIE value.
You can download this advisory from the following link: https://packetstormsecurity.com/files/download/90671/dsa-2060-1.txt
Source: https://packetstormsecurity.com/files/90671/Debian-Linux-Security-Advisory-2060-1.html