Security: defense-in-depth audit findings (34 items)

[somethingwithproof]

Defense-in-Depth Audit

An automated security audit identified 34 defense-in-depth opportunities in plugin_intropage.

Breakdown

SQLi(13), CMD(10), Path(10), CSRF(1)

Recommended fixes

• SQLi: Convert string-concatenated SQL to db_execute_prepared() / db_fetch_*_prepared()
• XSS: Wrap get_request_var() in HTML contexts with html_escape_request_var()
• CMD: Verify exec()/shell_exec() args use cacti_escapeshellarg()
• Path: Add realpath() + prefix validation for include/require with variable paths
• Deser: Add array('allowed_classes' => false) to unserialize() calls
• CSRF: Verify forms integrate with Cacti CSRF framework

All recommended changes are PHP 7.0+ compatible.

Related PR: #365

[somethingwithproof]

Fix PR open: #365