CVE-2011-4674 SQL injection vulnerability in popup.php in Zabbix 1.8.3 and 1.8.4, and possibly other versions before 1.8.9, allows remote attackers to execute arbitrary SQL commands via the only_hostid parameter.
HighCVSS 7.5
EPSS 2.4%
Public exploit
- Published
- Updated
- Exploit status
- Public exploit available
Description
SQL injection vulnerability in popup.php in Zabbix 1.8.3 and 1.8.4, and possibly other versions before 1.8.9, allows remote attackers to execute arbitrary SQL commands via the only_hostid parameter.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/zabbix(Debian:12) | < 1:1.8.9-1 | 1:1.8.9-1 |
| debian/zabbix(Debian:13) | < 1:1.8.9-1 | 1:1.8.9-1 |
| debian/zabbix(Debian:14) | < 1:1.8.9-1 | 1:1.8.9-1 |
| zabbix | = 1.8.3 | No fix listed |
| zabbix | = 1.8.4 | No fix listed |
References
- Debian Security Tracker CVE-2011-4674 vendor-advisory
- 18155 exploit
- 50803 exploit vdb-entry
- zabbix-popup-sql-injection(71479) vdb-entry
- support.zabbix.com exploit
- bugs.debian.org issue-tracking