ID de Prueba:	1.3.6.1.4.1.25623.1.0.106179
Categoría:	Web application abuses
Título:	Zabbix 2.2.x, 3.0.x SQLi Vulnerability
Resumen:	Zabbix is prone to a SQL injection (SQLi) vulnerability.
Descripción:	Summary: Zabbix is prone to a SQL injection (SQLi) vulnerability. Vulnerability Insight: Zabbix suffers from a remote SQL injection vulnerability due to a failure to sanitize input in the toggle_ids array in the latest.php page. Vulnerability Impact: An authenticated attacker (or guest user) is able to gain full access to the database. This would allow an attacker to escalate their privileges to a power user, compromise the database, or execute commands on the underlying database operating system. Because of the functionalities Zabbix offers, an attacker with admin privileges (depending on the configuration) can execute arbitrary OS commands on the configured Zabbix hosts and server. This results in a severe impact to the monitored infrastructure. Although the attacker needs to be authenticated in general, the system could also be at risk if the adversary has no user account. Zabbix offers a guest mode which provides a low privileged default account for users without password. If this guest mode is enabled, the SQL injection vulnerability can be exploited unauthenticated. Affected Software/OS: Zabbix version 2.2.x and 3.0.x. Solution: Update to version 2.2.14, 3.0.4 or later. CVSS Score: 7.5 CVSS Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Referencia Cruzada:	Common Vulnerability Exposure (CVE) ID: CVE-2016-10134 BugTraq ID: 95423 http://www.securityfocus.com/bid/95423 Debian Security Information: DSA-3802 (Google Search) http://www.debian.org/security/2017/dsa-3802 https://code610.blogspot.com/2017/10/zbx-11023-quick-autopsy.html http://www.openwall.com/lists/oss-security/2017/01/12/4 http://www.openwall.com/lists/oss-security/2017/01/13/4
Copyright	Copyright (C) 2016 Greenbone Networks GmbH

Esta es sólo una de 146377 pruebas de vulnerabilidad en nuestra serie de pruebas. Encuentre más sobre cómo ejecutar una auditoría de seguridad completa. Para ejecutar una prueba gratuita de esta vulnerabilidad contra su sistema, regístrese ahora.