PT-2012-4709 · Zabbix · Zabbix

Oleksii Zagorskyi · Publicado 2012-08-15 · Atualizado 2017-08-29 · CVE-2012-3435

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Zabbix versions 1.8.15rc1 and earlier Zabbix versions 2.x before 2.0.2rc1

Description The issue allows remote attackers to execute arbitrary SQL commands. This is achieved via the itemid parameter in the /frontends/php/popup bitem.php endpoint.

Recommendations For Zabbix versions 1.8.15rc1 and earlier, update to a version later than 1.8.15rc1. For Zabbix versions 2.x before 2.0.2rc1, update to version 2.0.2rc1 or later.

Exploit

Correção

RCE

SQL injection

Enumeração de Fraquezas

CWE-89

Identificadores relacionados

CVE-2012-3435

DSA-2539-1

Produtos afetados

Zabbix

Referências · 17

• 🔥 http://securityfocus.com/bid/54661 · Exploit
• 🔥 https://exploit-db.com/exploits/20087 · Exploit
• 🔥 http://git.zabbixzone.com/zabbix2.0/.git/commitdiff/333a3a5542ba8a2c901c24b7bf5440f41f1f4f54 · Exploit
• 🔥 http://exploit-db.com/exploits/20087 · Exploit
• https://exchange.xforce.ibmcloud.com/vulnerabilities/77195 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2012-3435 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2012-3435 · Aviso do Fabricante
• http://secunia.com/advisories/49809 · Aviso do Fabricante
• http://secunia.com/advisories/50475 · Nota
• http://openwall.com/lists/oss-security/2012/07/28/3 · Nota
• https://support.zabbix.com/browse/ZBX-5348 · Nota
• https://osv.dev/vulnerability/DEBIAN-CVE-2012-3435 · Aviso do Fabricante
• http://osvdb.org/84127 · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-3435 · Nota
• https://security-tracker.debian.org/tracker/CVE-2012-3435 · Aviso do Fabricante