Zabbix < 1.8.18 / 2.0.9 Multiple SQL Injection Vulnerabilities

Medium Nessus Network Monitor Plugin ID 8049


The remote host is running a web application that is vulnerable to a SQL-injection attack.


The remote host is running Zabbix, an IT monitoring service. Versions of Zabbix earlier than 1.8.18 or 2.0.9 are contain a number of SQL injection vulnerabilities via the API and web front end. The following API methods are reported to be vulnerable:

- alert.get: time_from, time_till;
- event.get: object, source, eventid_from, eventid_till;
- graphitem.get: parameter: type;
- graph.get: parameter: type;
- graphprototype.get: parameter: type;
- history.get: parameter: time_from, time_till;
- trigger.get: parameter: lastChangeSince, lastChangeTill, min_severity;
- triggerprototype.get: parameter: min_severity;
- usergroup.get: parameter: status

Other pages vulnerable to SQL injection include the "Dashboard", "Graphs", "Maps", "Latest data" and "Screens" pages in the "Monitoring" section. Successful attacks allow an attacker to gain access to the database and execute arbitrary SQL statements.


Upgrade to Zabbix 2.0.9 / 1.8.18 or later. Additionally, patches are available for versions 2.0.8 / 1.8.17 / 1.8.2.

See Also

Plugin Details

Severity: Medium

ID: 8049

File Name: 8049.prm

Family: Generic

Published: 2010/11/12

Modified: 2016/01/19

Dependencies: 1442

Nessus ID: 70497

Risk Information

Risk Factor: Medium


Base Score: 6.8

Temporal Score: 5.9

Vector: CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P

Temporal Vector: CVSS2#E:ND/RL:OF/RC:C


Base Score: 5.6

Temporal Score: 5.4


Temporal Vector: CVSS3#E:X/RL:O/RC:C

Vulnerability Information

Patch Publication Date: 2013/10/02

Vulnerability Publication Date: 2013/10/02

Exploitable With

Metasploit (linux/http/zabbix_sqli.rbcpe=cpe:/a:zabbix:zabbix)

Reference Information

CVE: CVE-2013-5743

BID: 62794

OSVDB: 98115, 98116