Unscored severity · published Apr 6, 2010
CVE-2010-1277
SQL injection vulnerability in the user.authenticate method in the API in Zabbix 1.8 before 1.8.2 allows remote attackers to execute arbitrary SQL commands via the user parameter…
–
CVSS
1.7%
EPSS
No
On KEV
Description
SQL injection vulnerability in the user.authenticate method in the API in Zabbix 1.8 before 1.8.2 allows remote attackers to execute arbitrary SQL commands via the user parameter in JSON data to api_jsonrpc.php.
Exploitation
Is it being used?
Exploit prediction (EPSS)1.7% · higher than 78% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
ZA
Zabbix · Zabbix
1.8; 1.8.1 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2010-1277
CVE.org
https://www.cve.org/CVERecord?id=CVE-2010-1277
Exploit
http://archives.neohapsis.com/archives/fulldisclosure/2010-04/0001.html
Exploit
http://legalhackers.com/advisories/zabbix181api-sql.txt
Exploit
http://legalhackers.com/poc/zabbix181api.pl-poc
Vendor Advisory
http://secunia.com/advisories/39119
www.osvdb.org
http://www.osvdb.org/63456
www.securityfocus.com
http://www.securityfocus.com/archive/1/510480/100/0/threaded
More from Zabbix
9.8
CVE-2022-23131
Unsafe client-side session storage leading to authentication bypass/instance takeover via Zabbix Frontend with configured SAML
5.3
CVE-2022-23134
Possible view of the setup pages by unauthenticated users if config file already exists
9.9
CVE-2024-42327
SQL injection in user.get API
9.8
CVE-2022-43516
A Firewall Rule which allows all incoming TCP connections to all programs from any source and to all ports is created in Windows Firewall after Zabbix agent installation (MSI)
9.8
CVE-2020-11800
Zabbix Server 2.2.x and 3.0.x before 3.0.31, and 3.2 allows remote attackers to execute arbitrary code