Zabbix 3.0.3 SQL Injection

Zabbix version 3.0.3 suffers from a remote SQL injection vulnerability.

==========================================Title:zabbix3.0.3SQL injection vulnerabilityproduct:zabbixvulnerable Version (s):2.2. x,3.0. xfixed Version:3.0.4homepage:http://www.zabbix.comPatch Link:https://support.zabbix.com/browse/zbx-11023Credit : [email protected]==========================================Vendor Description:=====================Zabbix isAn open source availability and performance monitoring solution. Vulnerability Overview:=====================Zabbix2.2. x,3.0. x and Trunk suffers fromA remote SQL injection vulnerability due to a failure to sanitize inputinchThe Toggle_ids arrayinchThe latest.php page. Business Impact:=====================by exploiting ThisSQL injection vulnerability, an authenticated attacker (or guest user) isable to gain full access to the database.  This would allow an attacker to escalate their privileges to a power user, compromise the database, or execute commands on The underlying database operating system. Because of the functionalities Zabbix offers, an attacker with admin privileges (depending on the configuration) can Execu Te arbitrary OS commands on the configured Zabbix hosts and server. This resultsincha severe impact to the monitored infrastructure. Although the attacker needs to be authenticatedinchGeneral, the system could also is at riskifThe adversary has no user account. Zabbix offers a guest mode which provides a low privilegeddefaultAccount forUsers without password. If ThisGuest Mode isenabled, the SQL injection vulnerability can be exploited unauthenticated. Proof of Concept:=====================latest.php? output=ajax&sid=&favobj=toggle&toggle_open_state=1&toggle_ids[]=15385);Select* fromUserswhere(1=1Result:sql (0.000361): INSERT into Profiles (profileID, UserID, idx, Value_int, type, idx2) VALUES ( the,1,'Web.latest.toggle','1',2,15385);Select* fromUserswhere(1=1) latest.php:746A require_once () a Cprofile::flush () a cprofile::insertdb () a dbexecute ()inch/home/sasha/zabbix-svn/branches/2.2/frontends/php/include/profiles.inc.php:185Disclosure Timeline:=====================7/ -/ .-reported vulnerability to Zabbix7/ +/ .-Zabbix responded with permission to file CVE and to disclose after a patch isMade Public7/ A/ .-Zabbix released Patch forVulnerability8/3/ .-CVE Details submitted8/ One/ .-Vulnerability Details disclosed

referer:https://packetstormsecurity.com/files/138312

Zabbix 3.0.3 SQL Injection