Zabbix version 3.0.3 suffers from a remote SQL injection vulnerability.

==========================================
Title: Zabbix 3.0. SQL Injection Vulnerability
Product: Zabbix
Vulnerable Version(s): 2.2.x, 3.0.x
Fixed Version: 3.0.
Homepage: http://www.zabbix.com
Patch link: https://support.zabbix.com/browse/ZBX-11023
Credit: 1N3@CrowdShield
========================================== Vendor Description:
=====================
Zabbix is an open source availability and performance monitoring solution. Vulnerability Overview:
=====================
Zabbix 2.2.x, 3.0.x and trunk suffers from a remote SQL injection vulnerability due to a failure to sanitize input in the toggle_ids array in the latest.php page. Business Impact:
=====================
By exploiting this SQL injection vulnerability, an authenticated attacker (or guest user) is able to gain full access to the database. This would allow an attacker to escalate their privileges to a power user, compromise the database, or execute commands on the underlying database operating system. Because of the functionalities Zabbix offers, an attacker with admin privileges (depending on the configuration) can execute arbitrary OS commands on the configured Zabbix hosts and server. This results in a severe impact to the monitored infrastructure. Although the attacker needs to be authenticated in general, the system could also be at risk if the adversary has no user account. Zabbix offers a guest mode which provides a low privileged default account for users without password. If this guest mode is enabled, the SQL injection vulnerability can be exploited unauthenticated. Proof of Concept:
===================== latest.php?output=ajax&sid=&favobj=toggle&toggle_open_state=&toggle_ids[]=); select * from users where (= Result:
SQL (0.000361): INSERT INTO profiles (profileid, userid, idx, value_int, type, idx2) VALUES (, , 'web.latest.toggle', '', , ); select * from users where (=)
latest.php: a require_once() a CProfile::flush() a CProfile::insertDB() a DBexecute() in /home/sasha/zabbix-svn/branches/2.2/frontends/php/include/profiles.inc.php: Disclosure Timeline:
===================== // - Reported vulnerability to Zabbix
// - Zabbix responded with permission to file CVE and to disclose after a patch is made public
// - Zabbix released patch for vulnerability
// - CVE details submitted
// - Vulnerability details disclosed

referer:https://packetstormsecurity.com/files/138312

Zabbix 3.0.3 SQL Injection的更多相关文章

  1. PHP+MYSQL网站SQL Injection攻防

    程序员们写代码的时候讲究TDD(测试驱动开发):在实现一个功能前,会先写一个测试用例,然后再编写代码使之运行通过.其实当黑客SQL Injection时,同样是一个TDD的过程:他们会先尝试着让程序报 ...

  2. SQL Injection(SQL注入漏洞)

    审计前准备: 1.安�php程序(推荐phpStudy) 2.高亮编辑器(推荐 Sublimetext Notepad++) 3.新建一个文本,复制以下变量,这些变量是审计中需要在源码中寻找的 ### ...

  3. zabbix 3.0 安装 ubuntu环境

    zabbix 3.0 安装 标签(空格分隔): 开发 [TOC] 下载deb # wget http://repo.zabbix.com/zabbix/3.0/ubuntu/pool/main/z/z ...

  4. HP+MYSQL网站SQL Injection攻防

    WebjxCom提示:程序员们写代码的时候讲究TDD(测试驱动开发):在实现一个功能前,会先写一个测试用例,然后再编写代码使之运行通过.其实当黑客SQL Injection时,同样是一个TDD的过程: ...

  5. [转]Zabbix 3.0 安装笔记

    Zabbix 3.0 只支持CentOS 7.0以上版本,所以先在虚拟机中安装好CentOS 7.0 x64,并设置好IP,允许虚拟机联网. 1.安装MySQL 从最新版本的linux系统开始,默认的 ...

  6. Cacti /graphs_new.php SQL Injection Vulnerability

    catalogue . 漏洞描述 . 漏洞触发条件 . 漏洞影响范围 . 漏洞代码分析 . 防御方法 . 攻防思考 1. 漏洞描述 other SQL injection vulnerability ...

  7. ecshop /search.php SQL Injection Vul

    catalog . 漏洞描述 . 漏洞触发条件 . 漏洞影响范围 . 漏洞代码分析 . 防御方法 . 攻防思考 1. 漏洞描述 ECSHOP商城系统Search.php页面过滤不严导致SQL注入漏洞 ...

  8. ecshop /pick_out.php SQL Injection Vul By Local Variable Overriding

    catalog . 漏洞描述 . 漏洞触发条件 . 漏洞影响范围 . 漏洞代码分析 . 防御方法 . 攻防思考 1. 漏洞描述 在进行输入变量本地模拟注册的时候,没有进行有效的GPC模拟过滤处理,导出 ...

  9. zabbix 3.0快速安装简介(centos 6)

    zabbix快速安装 系统版本:centos 6 1.yum源配置和zabbix.msyql安装 rpm -ivh http://mirrors.aliyun.com/zabbix/zabbix/3. ...

随机推荐

  1. 【iCore3 双核心板_FPGA】实验二十:基于FIFO的ARM+FPGA数据存取实验

    实验指导书及代码包下载: http://pan.baidu.com/s/1cmisnO iCore3 购买链接: https://item.taobao.com/item.htm?id=5242294 ...

  2. php数字操作,高精度函数,保留计算结果小数位

    $l = 45456.51; $r = 455778.44; $e = '100.00'; $f= '500.00'; $res = bcadd($l, $r,3);//小数点后的位数,精度就是由这个 ...

  3. python 正则使用笔记

    python正则使用笔记 def remove_br(content): """去除两边换行符""" content = content.r ...

  4. bootstrap加深

    1.安装: bootstrap中文网:http://www.bootcss.com/ bootstrap.css样式:http://v3.bootcss.com/css/#tables class=' ...

  5. 阅读廖雪峰老师git教程笔记

    1.首先git是目前世界上最先进的分布式版本控制系统之一.所谓版本控制是针对工作中一些普遍的现象的. 比如,你写一份文档,期间,不断的改善,每次修改都会进行备份,久而久之,会有很多版本的同一份文档,但 ...

  6. android:layout_gravity 和 android:gravity 的区别

    gravity 这个英文单词是重心的意思,在这里就表示停靠位置的意思. android:layout_gravity 和 android:gravity 的区别 从名字上可以看到,android:gr ...

  7. HTML添加多媒体或音乐

    1,添加多媒体 <embed src="多媒体文件地址" width="多媒体的宽度" height="多媒体的高度" autosta ...

  8. Django model '__week_day'与python datetime的weekday()

    上周出了个bug,按星期几查询数据的时候,发现查到的数据与显示的星期几并不相符,后来发现代码中按星期几查询,有的地方用的是Django QuerySet提供的'__week_day',有的地方用的是p ...

  9. IntelliJ IDEA全文搜索很给力

  10. Python开发【第二章】:Python深浅拷贝剖析

    Python深浅拷贝剖析 Python中,对象的赋值,拷贝(深/浅拷贝)之间是有差异的,如果使用的时候不注意,就可能产生意外的结果. 下面本文就通过简单的例子介绍一下这些概念之间的差别. 一.对象赋值 ...