CVE-2016-10134

Published: Feb 17, 2017Modified: May 13, 2026

9.8

Vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability: 3.9 / Impact: 5.9

Source: NVD

Description

SQL injection vulnerability in Zabbix before 2.2.14 and 3.0 before 3.0.4 allows remote attackers to execute arbitrary SQL commands via the toggle_ids array parameter in latest.php.

Affected (5)

Products: Zabbix: Zabbix

Zabbix

1 product

Zabbix

Configuration A

5 vulnerable

Vulnerable Software	Affected Versions
Zabbix Zabbix	Up to 2.2.13
Zabbix Zabbix	Version 3.0.0
Zabbix Zabbix	Version 3.0.1
Zabbix Zabbix	Version 3.0.2
Zabbix Zabbix	Version 3.0.3

Related CWEs

CWE-89

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.

References (14)

http://www.debian.org/security/2017/dsa-3802

Source: security@debian.org

http://www.openwall.com/lists/oss-security/2017/01/12/4

Source: security@debian.org

Mailing ListThird Party Advisory

http://www.openwall.com/lists/oss-security/2017/01/13/4

Source: security@debian.org

Mailing ListThird Party Advisory

http://www.securityfocus.com/bid/95423

Source: security@debian.org

Third Party AdvisoryVDB Entry

https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=850936

Source: security@debian.org

Third Party Advisory

https://code610.blogspot.com/2017/10/zbx-11023-quick-autopsy.html

Source: security@debian.org

https://support.zabbix.com/browse/ZBX-11023

Source: security@debian.org

ExploitPatchVendor Advisory

http://www.debian.org/security/2017/dsa-3802