In /chart_bar.php ,line 163.

$itemid = $item['itemid'];

$itemid is a value from gpc(GET,POST,COOKIE) at line 54 of the same file.

code from /chart_bar.php:

Line:54 $items = get_request('items', array());
......
Line:162 foreach ($items as $item) {
Line:163 $itemid = intval($item['itemid']);
Line:174 ' WHERE itemid='.$itemid.

There is a SQL inject vulnerability in the $sql_arr because the $itemid can be evil.