Published: 15/08/2012 Updated: 29/08/2017

CVSS v2 Base Score: 7.5 | Impact Score: 6.4 | Exploitability Score: 10

VMScore: 755

Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P

SQL injection vulnerability in frontends/php/popup_bitem.php in Zabbix 1.8.15rc1 and previous versions, and 2.x prior to 2.0.2rc1, allows remote malicious users to execute arbitrary SQL commands via the itemid parameter.

Vulnerable Product	Search on Vulmon	Subscribe to Product
zabbix zabbix
zabbix zabbix 1.7.4
zabbix zabbix 1.1
zabbix zabbix 1.1.6
zabbix zabbix 1.1.7
zabbix zabbix 1.4.6
zabbix zabbix 1.8.2
zabbix zabbix 1.1.3
zabbix zabbix 1.8.3
zabbix zabbix 1.4.5
zabbix zabbix 1.5.2
zabbix zabbix 1.5.1
zabbix zabbix 1.7.1
zabbix zabbix 1.6.8
zabbix zabbix 1.3
zabbix zabbix 1.3.1
zabbix zabbix 1.1.2
zabbix zabbix 1.8
zabbix zabbix 1.8.1
zabbix zabbix 1.3.8
zabbix zabbix 1.5
zabbix zabbix 1.6.2
zabbix zabbix 1.6.3
zabbix zabbix 2.0.0
zabbix zabbix 2.0.1
zabbix zabbix 1.7.2
zabbix zabbix 1.6.7
zabbix zabbix 1.6.6
zabbix zabbix 1.3.2
zabbix zabbix 1.3.3
zabbix zabbix 1.7
zabbix zabbix 1.1.4
zabbix zabbix 1.4.2
zabbix zabbix 1.3.7
zabbix zabbix 1.6.1
zabbix zabbix 1.6
zabbix zabbix 1.6.5
zabbix zabbix 1.6.4
zabbix zabbix 1.7.3
zabbix zabbix 1.1.1
zabbix zabbix 1.3.4
zabbix zabbix 1.3.5
zabbix zabbix 1.4.4
zabbix zabbix 1.4.3
zabbix zabbix 1.1.5
zabbix zabbix 1.3.6
zabbix zabbix 1.5.3
zabbix zabbix 1.5.4
zabbix zabbix 1.6.9

Debian Bug report logs - #683273 CVE-2012-3435 Package: zabbix; Maintainer for zabbix is Dmitry Smirnov <onlyjob@debianorg>; Reported by: Moritz Muehlenhoff <muehlenhoff@univentionde> Date: Mon, 30 Jul 2012 12:33:02 UTC Severity: grave Tags: security Found in versions 1:182-1, 1:182-1squeeze2 Fixed in versions ...

It was discovered that Zabbix, a network monitoring solution, does not properly validate user input used as a part of an SQL query This may allow unauthenticated attackers to execute arbitrary SQL commands (SQL injection) and possibly escalate privileges For the stable distribution (squeeze), this problem has been fixed in version 1:182-1squeez ...

#!/usr/bin/python import re import sys,urllib2,urllib print "\n[*] Zabbix 201 Session Extractor 0day" print "[*] wwwoffensive-securitycom" print "##################################\n" ''' The sessions found by this tool may allow you to access the scriptsphp file Through this web interface, an administrator can define new maliciou ...

CWE-89 http://www.securityfocus.com/bid/54661 http://secunia.com/advisories/49809 https://support.zabbix.com/browse/ZBX-5348 http://www.exploit-db.com/exploits/20087 http://www.openwall.com/lists/oss-security/2012/07/28/3 http://git.zabbixzone.com/zabbix2.0/.git/commitdiff/333a3a5542ba8a2c901c24b7bf5440f41f1f4f54 http://osvdb.org/84127 http://www.openwall.com/lists/oss-security/2012/07/27/6 http://www.debian.org/security/2012/dsa-2539 http://secunia.com/advisories/50475 https://exchange.xforce.ibmcloud.com/vulnerabilities/77195 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=683273 https://nvd.nist.gov https://www.exploit-db.com/exploits/20087/https://www.debian.org/security/./dsa-2539

CVE-2012-3435

Vulnerability Summary

Vendor Advisories

Exploits

References

Vulmon Search

About

Products

Connect