Cacti bug#0002405 includes fixes for SQL injection and shell escaping (which could lead to arbitrary command execution). Fixes are available from:

http://svn.cacti.net/viewvc?view=rev&revision=7439

CVE-2014-2708 is for the SQL injection issues in graphxport.php.

CVE-2014-2709 is for the shell escaping issues in lib/rrd.php

References:

http://seclists.org/oss-sec/2014/q2/15

lib/rrd.php in Cacti 0.8.7g, 0.8.8b, and earlier allows remote attackers to execute arbitrary commands via shell metacharacters in unspecified parameters.

Cross-site request forgery (CSRF) vulnerability in Cacti 0.8.7g, 0.8.8b, and earlier allows remote attackers to hijack the authentication of users for unspecified commands, as demonstrated by requests that (1) modify binary files, (2) modify configurations, or (3) add arbitrary users.

lib/graphexport.php in Cacti 0.8.7g, 0.8.8b, and earlier allows remote authenticated users to execute arbitrary commands via shell metacharacters in unspecified vectors.

Multiple cross-site scripting (XSS) vulnerabilities in Cacti 0.8.8b allow remote attackers to inject arbitrary web script or HTML via the (1) drpaction parameter to cdef.php, (2) datainput.php, (3) dataqueries.php, (4) datasources.php, (5) datatemplates.php, (6) graphtemplates.php, (7) graphs.php, (8) host.php, or (9) hosttemplates.php or the (10) graphtemplateinputid or (11) graphtemplateid parameter to graphtemplatesinputs.php.