CVE-2011-4674: SQL Injection
Published Dec 2, 2011
·Updated
SQL injection vulnerability in popup.php in Zabbix 1.8.3 and 1.8.4, and possibly other versions before 1.8.9, allows remote attackers to execute arbitrary SQL commands via the onlyhostid parameter.
Affected Software
2 affected components
Zabbix Zabbix=1.8.3
Zabbix Zabbix=1.8.4
Event History
Dec 2, 2011
CVE Published
via MITRE·06:00 PM
Data Sourced
via MITRE·06:00 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2011-4674?
CVE-2011-4674 is classified as a medium severity SQL injection vulnerability that allows the execution of arbitrary SQL commands.
2
How do I fix CVE-2011-4674?
To fix CVE-2011-4674, upgrade Zabbix to version 1.8.9 or later, which addresses this SQL injection vulnerability.
3
Which versions of Zabbix are affected by CVE-2011-4674?
CVE-2011-4674 affects Zabbix versions 1.8.3, 1.8.4, and potentially earlier versions.
4
Can CVE-2011-4674 be exploited remotely?
Yes, CVE-2011-4674 can be exploited remotely by attackers to execute arbitrary SQL commands.
5
What component of Zabbix is vulnerable in CVE-2011-4674?
The popup.php component of Zabbix is vulnerable in CVE-2011-4674 due to improper validation of the only_hostid parameter.