PT-2010-2982 · Zabbix · Zabbix

Dawid Golunski · Publicado 2010-04-06 · Atualizado 2018-10-10 · CVE-2010-1277

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Zabbix versions 1.8 through 1.8.1 Zabbix version 1.8

Description A SQL injection issue exists in the user.authenticate method in the API, allowing remote attackers to execute arbitrary SQL commands via the user parameter in JSON data to "api jsonrpc.php".

Recommendations For Zabbix versions 1.8 through 1.8.1, update to version 1.8.2 or later. For Zabbix version 1.8, update to version 1.8.2 or later.

Exploit

Correção

RCE

SQL injection

Enumeração de Fraquezas

CWE-89

Identificadores relacionados

CVE-2010-1277

Produtos afetados

Zabbix

Referências · 14

• 🔥 http://legalhackers.com/advisories/zabbix181api-sql.txt · Exploit
• 🔥 http://archives.neohapsis.com/archives/fulldisclosure/2010-04/0001.html · Exploit
• 🔥 http://securityfocus.com/bid/39148 · Exploit
• 🔥 http://legalhackers.com/poc/zabbix181api.pl-poc · Exploit
• http://vupen.com/english/advisories/2010/0799 · Aviso do Fabricante
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1277 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2010-1277 · Nota de Segurança
• http://osvdb.org/63456 · Nota
• http://securityfocus.com/archive/1/510480/100/0/threaded · Nota
• http://secunia.com/advisories/39119 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2010-1277 · Aviso do Fabricante
• https://security-tracker.debian.org/tracker/CVE-2010-1277 · Aviso do Fabricante
• https://osv.dev/vulnerability/DEBIAN-CVE-2010-1277 · Aviso do Fabricante
• http://zabbix.com/rn1.8.2.php · Correção