ZABBIX API and Frontend CVE-2013-5743 Multiple SQL Injection Vulnerabilities
BID:62794
Info
ZABBIX API and Frontend CVE-2013-5743 Multiple SQL Injection Vulnerabilities
| Bugtraq ID: | 62794 |
| Class: | Input Validation Error |
| CVE: |
CVE-2013-5743 |
| Remote: | Yes |
| Local: | No |
| Published: | Oct 02 2013 12:00AM |
| Updated: | Oct 16 2013 12:54AM |
| Credit: | Bernhard Schildendorfer from SEC Consult and Lincoln, a member of Corelan Team. |
| Vulnerable: |
ZABBIX ZABBIX 1.8.9 ZABBIX ZABBIX 1.8.7 ZABBIX ZABBIX 1.8.6 ZABBIX ZABBIX 1.8.3 ZABBIX ZABBIX 1.8.2 ZABBIX ZABBIX 1.8.1 ZABBIX ZABBIX 1.7.4 ZABBIX ZABBIX 1.7.3 ZABBIX ZABBIX 1.7.2 ZABBIX ZABBIX 1.7.1 ZABBIX ZABBIX 1.6.8 ZABBIX ZABBIX 1.6.7 ZABBIX ZABBIX 1.6.6 ZABBIX ZABBIX 1.6.5 ZABBIX ZABBIX 1.6.4 ZABBIX ZABBIX 1.6.3 ZABBIX ZABBIX 1.6.2 ZABBIX ZABBIX 1.4.6 ZABBIX ZABBIX 1.4.5 ZABBIX ZABBIX 1.4.3 ZABBIX ZABBIX 1.4.2 ZABBIX ZABBIX 1.1.7 ZABBIX ZABBIX 1.1.5 ZABBIX ZABBIX 1.1.4 ZABBIX ZABBIX 1.1.3 ZABBIX ZABBIX 1.1.2 ZABBIX ZABBIX 1.8.5 ZABBIX ZABBIX 1.8 ZABBIX ZABBIX 1.7 ZABBIX ZABBIX 1.6.9 ZABBIX ZABBIX 1.6.1 ZABBIX ZABBIX 1.6 ZABBIX ZABBIX 1.5.4 Beta ZABBIX ZABBIX 1.5.3 Beta ZABBIX ZABBIX 1.5.2 Beta ZABBIX ZABBIX 1.5.1 Beta ZABBIX ZABBIX 1.5 Beta ZABBIX ZABBIX 1.4.4 ZABBIX ZABBIX 1.3.8 Beta ZABBIX ZABBIX 1.3.7 Beta ZABBIX ZABBIX 1.3.6 Beta ZABBIX ZABBIX 1.3.5 Beta ZABBIX ZABBIX 1.3.4 Beta ZABBIX ZABBIX 1.3.3 Beta ZABBIX ZABBIX 1.3.2 Beta ZABBIX ZABBIX 1.3.1 Beta ZABBIX ZABBIX 1.3 Beta ZABBIX ZABBIX 1.1.6 ZABBIX ZABBIX 1.1.1 ZABBIX ZABBIX 1.1 |
| Not Vulnerable: | |
Discussion
ZABBIX API and Frontend CVE-2013-5743 Multiple SQL Injection Vulnerabilities
ZABBIX API and Frontend are prone to multiple SQL-injection vulnerabilities.
A successful exploit may allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
The following versions are vulnerable:
ZABBIX prior to 2.0.9
ZABBIX prior to 1.8.18
ZABBIX API and Frontend are prone to multiple SQL-injection vulnerabilities.
A successful exploit may allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
The following versions are vulnerable:
ZABBIX prior to 2.0.9
ZABBIX prior to 1.8.18
Exploit / POC
ZABBIX API and Frontend CVE-2013-5743 Multiple SQL Injection Vulnerabilities
An attacker can exploit these issues using a web browser.
The following metasploit exploit is available:
An attacker can exploit these issues using a web browser.
The following metasploit exploit is available:
Solution / Fix
ZABBIX API and Frontend CVE-2013-5743 Multiple SQL Injection Vulnerabilities
Solution:
Updates are available. Please see the references or vendor advisory for more information.
Solution:
Updates are available. Please see the references or vendor advisory for more information.
References
ZABBIX API and Frontend CVE-2013-5743 Multiple SQL Injection Vulnerabilities
References:
References: