CVE-2016-10134: zabbix SQL Injection

CVSS: 9.8v3.0CriticalModified

AliasesALPINE-CVE-2016-10134UBUNTU-CVE-2016-10134DEBIAN-CVE-2016-10134+1 more

Published 16-02-2017Last modified 06-08-2024

Vulnerability summary

CVE-2016-10134 is a critical (CVSS 9.8) SQL Injection vulnerability in zabbix. EPSS estimates a 83.41% chance of exploitation in the next 30 days, higher than 99.6% of scored vulnerabilities. 2 public exploits are recorded.

Overall risk

70/100

0100

High · default modelHow is this calculated?

CVSS score

9.8/10

010

Critical · v3.0 (NVD)

EPSS score

83.41%

0%100%

Critical · 0.00 pp in 30 days

KEVNot listedIn no KEV catalog

RansomwareNone recordedNo known use recorded

Public exploits2reference, metasploit

Advisory lineage

Upstream 0 · Downstream 1 · Related 1

USN-4767-1

Timeline

16-02-2017
PublishedVulnerability first disclosed.
06-08-2024
Last modifiedVulnerability information updated.

Description

SQL injection vulnerability in Zabbix before 2.2.14 and 3.0 before 3.0.4 allows remote attackers to execute arbitrary SQL commands via the toggle_ids array parameter in latest.php.

CVSS metrics

5 scores · 4 sources · 2 versions

v3.09.8v2.07.5

EPSS trend

Probability

83.41%

Chance of exploitation in the next 30 days

Percentile

100%

Versus all other CVEs

30-day change

0.00 pp

From 83.41% on 19-09-2026

19-09-202619-10-2026

EPSS score

83.41%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

2 found

referenceUnverified
Exploit Reference (support.zabbix.com)
Maturity: unknown
MetasploitremoteUnverified
Zabbix toggle_ids SQL Injection
auxiliary/gather/zabbix_toggleids_sqli
Maturity: poc

Weaknesses

CWE · root cause

CWE-89Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.

Affected systems

Alpine1 product

zabbix< 3.0.4-r0

Debian1 product

zabbix< 1:3.0.4+dfsg-1 | < 1:2.2.7+dfsg-2+deb8u2

Ubuntu1 product

zabbix< 1:2.2.2+dfsg-1ubuntu1+esm1

Zabbix1 product

zabbix≤ 2.2.13 | 3.0.0 | 3.0.1 | 3.0.2 | 3.0.3

4 vendors · 4 products

References

12 links

code610.blogspot.com/2017/10/zbx-11023-quick-autopsy.htmlX Refsource MISC
www.openwall.com/lists/oss-security/2017/01/12/4Mailing ListX Refsource MLISTThird Party AdvisoryREPORT
www.debian.org/security/2017/dsa-3802Vendor AdvisoryX Refsource DEBIAN
www.openwall.com/lists/oss-security/2017/01/13/4Mailing ListX Refsource MLISTThird Party Advisory
bugs.debian.org/cgi-bin/bugreport.cgi?bug=850936X Refsource CONFIRMThird Party Advisory
www.securityfocus.com/bid/95423VDB EntryX Refsource BIDThird Party Advisory
support.zabbix.com/browse/ZBX-11023X Refsource CONFIRMExploitPatchVendor AdvisoryREPORT
security.alpinelinux.org/vuln/CVE-2016-10134Advisory
ubuntu.com/security/CVE-2016-10134REPORT
www.cve.org/CVERecord?id=CVE-2016-10134REPORT

Show all 12 references

ubuntu.com/security/notices/USN-4767-1Advisory
security-tracker.debian.org/tracker/CVE-2016-10134Advisory

Vulnerability summary

Advisory lineage

Timeline

Description

CVSS metrics

EPSS trend

Known exploited

Public exploits

Weaknesses

Affected systems

References

Related vulnerabilities