PT-2012-4709 · Zabbix · Zabbix

Oleksii Zagorskyi · Published 2012-08-15 · Updated 2017-08-29 · CVE-2012-3435

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Zabbix versions 1.8.15rc1 and earlier Zabbix versions 2.x before 2.0.2rc1

Description The issue allows remote attackers to execute arbitrary SQL commands. This is achieved via the itemid parameter in the /frontends/php/popup bitem.php endpoint.

Recommendations For Zabbix versions 1.8.15rc1 and earlier, update to a version later than 1.8.15rc1. For Zabbix versions 2.x before 2.0.2rc1, update to version 2.0.2rc1 or later.

Exploit

Fix

RCE

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2012-3435

DSA-2539-1

Affected Products

Zabbix

References · 17

• 🔥 http://securityfocus.com/bid/54661 · Exploit
• 🔥 https://exploit-db.com/exploits/20087 · Exploit
• 🔥 http://git.zabbixzone.com/zabbix2.0/.git/commitdiff/333a3a5542ba8a2c901c24b7bf5440f41f1f4f54 · Exploit
• 🔥 http://exploit-db.com/exploits/20087 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2012-3435 · Security Note
• https://osv.dev/vulnerability/CVE-2012-3435 · Vendor Advisory
• http://secunia.com/advisories/49809 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2012-3435 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2012-3435 · Vendor Advisory
• http://debian.org/security/2012/dsa-2539 · Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/77195 · Note
• http://secunia.com/advisories/50475 · Note
• http://openwall.com/lists/oss-security/2012/07/28/3 · Note
• https://support.zabbix.com/browse/ZBX-5348 · Note
• http://osvdb.org/84127 · Note