security(mactrack): remediate SQL injection in non-view files

mactrack_macauth.php: api_mactrack_maca_save() interpolated the user-supplied MAC address into an UPDATE ... LIKE "...%" (first-order SQLi); now bound via db_execute_prepared() with a ? placeholder. api_mactrack_maca_remove() called db_execute_prepared() while concatenating the (stored) mac_address into the SQL with no bound params (second-order SQLi + misuse of the prepared helper); the three DELETEs now bind mac_address as a parameter.

mactrack_devices.php: Copy SNMP Settings (drp_action==7) built its UPDATE SET clause by interpolating host-table values with bare quotes; values are now bound with placeholders (column name stays interpolated as a trusted static-array key). Mirrors the fix already applied on the Cacti#334 branch.

mactrack_device_types.php, mactrack_sites.php, mactrack_snmp.php: (int)-cast the remaining raw numeric request vars (type_id, site_id, and id used in snmp_id= fragments for move_item_up/down and get_sequence) — defense-in-depth over the FILTER_VALIDATE_INT request validation. 1.2.31-idiomatic, PHP 7.4-safe.

Co-Authored-By: Oz <oz-agent@warp.dev>

Author: 2 people

mactrack_device_types.php

@@ -915,7 +915,7 @@ function mactrack_get_device_types(&$sql_where, $rows, $apply_limits = true) {
 	if (get_request_var('type_id') == '-1') {
 		// Show all items
 	} else {
-		$sql_where .= ($sql_where != '' ? ' AND ' : ' WHERE ') . '(mtdt.device_type=' . get_request_var('type_id') . ')';
+		$sql_where .= ($sql_where != '' ? ' AND ' : ' WHERE ') . '(mtdt.device_type=' . (int) get_request_var('type_id') . ')';
 	}
 
 	if (get_request_var('enabled') == '-1') {

mactrack_devices.php

@@ -202,19 +202,26 @@ function form_mactrack_actions() {
 
 					if (isset($cacti_host['id'])) {
 						reset($fields_mactrack_snmp_item);
-						$updates = '';
+						$set_clauses = [];
+						$set_params  = [];
 
 						foreach ($fields_mactrack_snmp_item as $field_name => $field_array) {
 							if (isset($cacti_host[$field_name])) {
-								$updates .= ($updates != '' ? ', ' : '') . $field_name . "='" . $cacti_host[$field_name] . "'";
+								// $field_name is a trusted key from the static $fields_mactrack_snmp_item
+								// definition; the host-table value is bound as a parameter to avoid
+								// second-order SQL injection when it contains a quote.
+								$set_clauses[] = $field_name . ' = ?';
+								$set_params[]  = $cacti_host[$field_name];
 							}
 						}
 
-						if ($updates != '') {
+						if (cacti_sizeof($set_clauses)) {
+							$set_params[] = $selected_items[$i];
+
 							db_execute_prepared('UPDATE mac_track_devices
-								SET ' . $updates . '
-								WHERE device_id=?',
-								[$selected_items[$i]]);
+								SET ' . implode(', ', $set_clauses) . '
+								WHERE device_id = ?',
+								$set_params);
 						}
 					} else {
 						// skip silently; possible enhancement: tell the user what we did

mactrack_macauth.php

@@ -174,9 +174,10 @@ function api_mactrack_maca_save($mac_id, $mac_address, $description) {
 		$mac_id = sql_save($save, 'mac_track_macauth', 'mac_address', false);
 
 		if ($mac_id) {
-			db_execute('UPDATE mac_track_ports
+			db_execute_prepared('UPDATE mac_track_ports
 				SET authorized=1
-				WHERE mac_address LIKE "' . $mac_address . '%"');
+				WHERE mac_address LIKE ?',
+				[$mac_address . '%']);
 
 			raise_message(1);
 		} else {
@@ -198,13 +199,16 @@ function api_mactrack_maca_remove($mac_id) {
 		[$mac_id]);
 
 	db_execute_prepared('DELETE FROM mac_track_ips
-		WHERE mac_address="' . $mac_address . '"');
+		WHERE mac_address = ?',
+		[$mac_address]);
 
 	db_execute_prepared('DELETE FROM mac_track_ports
-		WHERE mac_address="' . $mac_address . '"');
+		WHERE mac_address = ?',
+		[$mac_address]);
 
 	db_execute_prepared('DELETE FROM mac_track_aggregated_ports
-		WHERE mac_address="' . $mac_address . '"');
+		WHERE mac_address = ?',
+		[$mac_address]);
 
 	cacti_log('AUDIT: MAC Address `' . $mac_address . '` is deleted from MacAuth by ' .
 		db_fetch_cell_prepared('SELECT full_name FROM user_auth WHERE id = ?', [$_SESSION['sess_user_id']]), false, 'MACTRACK');

mactrack_sites.php

@@ -304,7 +304,7 @@ function mactrack_site_get_site_records(&$sql_where, $rows, $apply_limits = true
 	}
 
 	if ((get_request_var('site_id') != '-1') && (get_request_var('detail'))) {
-		$sql_where .= ($sql_where != '' ? ' AND ' : 'WHERE ') . '(mtd.site_id=' . get_request_var('site_id') . ')';
+		$sql_where .= ($sql_where != '' ? ' AND ' : 'WHERE ') . '(mtd.site_id=' . (int) get_request_var('site_id') . ')';
 	}
 
 	$sql_order = get_order_string();

mactrack_snmp.php

@@ -297,7 +297,7 @@ function mactrack_snmp_item_movedown() {
 	get_filter_request_var('id');
 	// ====================================================
 
-	move_item_down('mac_track_snmp_items', get_request_var('item_id'), 'snmp_id=' . get_request_var('id'));
+	move_item_down('mac_track_snmp_items', get_request_var('item_id'), 'snmp_id=' . (int) get_request_var('id'));
 }
 
 function mactrack_snmp_item_moveup() {
@@ -306,7 +306,7 @@ function mactrack_snmp_item_moveup() {
 	get_filter_request_var('id');
 	// ====================================================
 
-	move_item_up('mac_track_snmp_items', get_request_var('item_id'), 'snmp_id=' . get_request_var('id'));
+	move_item_up('mac_track_snmp_items', get_request_var('item_id'), 'snmp_id=' . (int) get_request_var('id'));
 }
 
 function mactrack_snmp_item_remove() {
@@ -347,7 +347,7 @@ function mactrack_snmp_item_edit() {
 
 		$mactrack_snmp_item             = [];
 		$mactrack_snmp_item['snmp_id']  = get_request_var('id');
-		$mactrack_snmp_item['sequence'] = get_sequence('', 'sequence', 'mac_track_snmp_items', 'snmp_id=' . get_request_var('id'));
+		$mactrack_snmp_item['sequence'] = get_sequence('', 'sequence', 'mac_track_snmp_items', 'snmp_id=' . (int) get_request_var('id'));
 	}
 
 	form_start(get_current_page(), 'mactrack_item_edit');