CVE-2010-1277: SQL Injection
First published: Tue Apr 06 2010(Updated: )
SQL injection vulnerability in the user.authenticate method in the API in Zabbix 1.8 before 1.8.2 allows remote attackers to execute arbitrary SQL commands via the user parameter in JSON data to api_jsonrpc.php.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Zabbix Server | =1.8 | |
| Zabbix Server | =1.8.1 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://www.securityfocus.com/bid/39148
- http://archives.neohapsis.com/archives/fulldisclosure/2010-04/0001.html
- http://legalhackers.com/advisories/zabbix181api-sql.txt
- http://www.zabbix.com/rn1.8.2.php
- http://secunia.com/advisories/39119
- http://www.osvdb.org/63456
- http://legalhackers.com/poc/zabbix181api.pl-poc
- http://www.vupen.com/english/advisories/2010/0799
- http://www.securityfocus.com/archive/1/510480/100/0/threaded
Frequently Asked Questions
What is the severity of CVE-2010-1277?
CVE-2010-1277 is classified as a medium severity SQL injection vulnerability.
How do I fix CVE-2010-1277?
To fix CVE-2010-1277, upgrade the Zabbix server to version 1.8.2 or later.
What software is affected by CVE-2010-1277?
CVE-2010-1277 affects Zabbix versions 1.8 and 1.8.1.
What type of vulnerability is CVE-2010-1277?
CVE-2010-1277 is an SQL injection vulnerability that allows remote attackers to execute arbitrary SQL commands.
Can CVE-2010-1277 be exploited remotely?
Yes, CVE-2010-1277 can be exploited remotely through the user.authenticate method in the API.
- agent/type
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/severity
- agent/references
- agent/author
- agent/description
- agent/remedy
- agent/first-publish-date
- agent/event
- agent/source
- agent/weakness
- agent/tags
- agent/softwarecombine
- collector/nvd-historical
- agent/software-canonical-lookup-request
- collector/nvd-index
- vendor/zabbix
- canonical/zabbix server
- version/zabbix server/1.8
- version/zabbix server/1.8.1