The remote web server hosts a version of the Zabbix web interface that is affected by a remote code execution vulnerability.  The vulnerability involves the 'extlang[]' parameter of the 'locales.php' script.
Provided PHP's 'magic_quotes_gpc' setting is disabled, an unauthenticated, remote attacker can exploit this to execute arbitrary code on the remote host subject to the privileges of the web server user id.

Note that this version of the Zabbix web interface is also likely affected by a local file include vulnerability and a cross-site request forgery vulnerability.

Detections

Analytics

Zabbix Web Interface extlang[] Parameter Remote Code Execution

high Nessus Plugin ID 35787