Multiple SQL injection vulnerabilities in Zabbix 1.8.x before 1.8.18rc1, 2.0.x before 2.0.9rc1, and 2.1.x before 2.1.7.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Multiple SQL injection vulnerabilities in Zabbix 1.8.x before 1.8.18rc1, 2.0.x before 2.0.9rc1, and 2.1.x
    before 2.1.7. (CVE-2013-5743)

According to its self-reported version number, the instance of Zabbix listening on the remote host is a version prior to 1.8.18rc1 / 2.0.9rc1 / 2.1.7.  It is, therefore, potentially affected by multiple SQL injection vulnerabilities.  The following API methods and parameters are reportedly affected :

  - alert.get            parameters : time_from, time_till
  - event.get            parameters : object, source, eventid_from, eventid_till
  - graphitem.get        parameter  : type
  - graph.get            parameters : type
  - graphprototype.get   parameter  : type
  - history.get          parameters : time_from, time_till
  - trigger.get          parameters : lastChangeSince, lastChangeTill, min_severity
  - triggerprototype.get parameter  : min_severity
  - usergroup.get        parameter  : status

Additionally, code used to add objects such as graphs or maps to favorites is reportedly also affected by SQL injection attacks.  The 'Dashboard', 'Graphs', 'Maps', 'Latest data', and 'Screens' pages in the 'Monitoring' section are reported to be affected. 

Note that Nessus has not tested for these issues but has instead relied on the version in the Zabbix login page.

The remote host is running Zabbix, an IT monitoring service.  Versions of Zabbix earlier than 1.8.18 or 2.0.9 are contain a number of SQL injection vulnerabilities via the API and web front end. The following API methods are reported to be vulnerable:

  - alert.get: time_from, time_till;
  - event.get: object, source, eventid_from, eventid_till;
  - graphitem.get: parameter: type;
  - graph.get: parameter: type;
  - graphprototype.get: parameter: type;
  - history.get: parameter: time_from, time_till;
  - trigger.get: parameter: lastChangeSince, lastChangeTill, min_severity;
  - triggerprototype.get: parameter: min_severity;
  - usergroup.get: parameter: status

Other pages vulnerable to SQL injection include the "Dashboard", "Graphs", "Maps", "Latest data" and "Screens" pages in the "Monitoring" section. Successful attacks allow an attacker to gain access to the database and execute arbitrary SQL statements.

ID	Name	Product	Family	Severity
401212	Alpine: multiple zabbix packages: security update to 2.0.8-r2 (deprecated)	Tenable Cloud Security	Alpine Linux Local Security Checks	critical
401212	Alpine: multiple zabbix packages: security update to 2.0.8-r2 (deprecated)	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	critical
70497	Zabbix < 1.8.18rc1 / 2.0.9rc1 / 2.1.7 Multiple SQL Injections	Nessus	CGI abuses	medium
8049	Zabbix < 1.8.18 / 2.0.9 Multiple SQL Injection Vulnerabilities	Nessus Network Monitor	Generic	medium

Detections

Analytics

CVE-2013-5743

critical

Tenable Plugins

critical

critical

medium

medium