http://git.zabbixzone.com/zabbix2.0/.git/commitdiff/333a3a5542ba8a2c901c24b7bf5440f41f1f4f54

84127

49809

50475

DSA-2539

20087

[oss-security] 20120727 Zabbix SQL injection flaw (CVE request)

[oss-security] 20120728 Re: Zabbix SQL injection flaw (CVE request)

54661

zabbix-popupbitem-sql-injection(77195)

https://support.zabbix.com/browse/ZBX-5348

The remote host is affected by the vulnerability described in GLSA-201311-15 (Zabbix: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Zabbix. Please review       the CVE identifiers referenced below for details.
  Impact :

    A remote attacker may be able to execute arbitrary SQL statements, cause       a Denial of Service condition, or obtain sensitive information.
  Workaround :

    There is no known workaround at this time.

The remote web server hosts a version of the Zabbix web interface that is affected by a SQL injection vulnerability.  The vulnerability exists in the 'popup_bitem.php' script, which fails to properly sanitize user-supplied input to the 'itemid' parameter before using it in database queries.  This could allow an attacker to manipulate such queries, resulting in manipulation or disclosure of arbitrary data.

It was discovered that Zabbix, a network monitoring solution, does not properly validate user input used as a part of a SQL query. This may allow unauthenticated attackers to execute arbitrary SQL commands (SQL injection) and possibly escalate privileges.

ID	Name	Product	Family	Severity
71089	GLSA-201311-15 : Zabbix: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
62757	Zabbix Web Interface popup_bitem.php itemid Parameter SQL Injection	Nessus	CGI abuses	high
62000	Debian DSA-2539-1 : zabbix - SQL injection	Nessus	Debian Local Security Checks	high

CVE-2012-3435

high

Tenable Plugins

high

high

high