xss in spikekill.php via para method

[kevinoclam]

it's not a high level vuln, maybe medium or low
line 37
echo __("FATAL: Spike Kill method '%s' is Invalid\n", get_nfilter_request_var('method'));
should change into
echo __("FATAL: Spike Kill method '%s' is Invalid\n", htmlspecialchars(get_nfilter_request_var('method')));

I should found this at issue 877, I'm sorry for the delay

chen ruiqi
codesafe team of qihoo 360

[cigamit]

Resolved. Thanks for making Cacti a better tool!

[carnil]

This issue has been assigned CVE-2017-12927