CVE Feed

    Dashboard / CVE / CVE-2012-3435

    CVE-2012-3435

    SQL injection vulnerability in frontends/php/popup_bitem.php in Zabbix 1.8.15rc1 and earlier, and 2.x before 2.0.2rc1, allows remote attackers to execute arbitrary SQL commands via the itemid parameter.

    Published:Aug 15, 2012
    Last Modified:Apr 11, 2025
    EPS:Aug 15, 2012
    EPSS Score:0.02759
    CVSS Score:7.5

    Affected Products

    Vendor
    Zabbix
    Product
    Zabbix

    Exploits

    http://git.zabbixzone.com/zabbix2.0/.git/commitdiff/333a3a5542ba8a2c901c24b7bf5440f41f1f4f54http://www.exploit-db.com/exploits/20087http://www.securityfocus.com/bid/54661http://git.zabbixzone.com/zabbix2.0/.git/commitdiff/333a3a5542ba8a2c901c24b7bf5440f41f1f4f54http://www.exploit-db.com/exploits/20087http://www.securityfocus.com/bid/54661https://www.exploit-db.com/exploits/20087

    Related CVEs

    CVE-2026-59781 (CVSS 5.4) — When Zabbix Agent was installed on Windows into a custom installation directory, the installer did not verify …
    CVE-2026-23938 (CVSS 2.1) — An authenticated administrator is able to crash Zabbix server or proxy by creating specifically crafted prepro…
    CVE-2026-23937 (CVSS 6) — The Zabbix API host.get action can be exploited by authenticated users to extract a host's PSK key leading to …
    CVE-2026-23935 (CVSS 6.8) — A Zabbix administrator is able to read out of bounds memory by utilizing a flaw in script item/preprocessing (…
    CVE-2026-23934 (CVSS 5.1) — An authenticated user is able to cause disproportionate CPU load on the Frontend webserver by sending specific…
    CVE-2026-23933 (CVSS 7.7) — In Zabbix 7.4 the cryptographic key used for signing Frontend sessions has been erroneously written to the dat…
    CVE-2026-23931 (CVSS 5.3) — The frontend validatate.api.exists action can be exploited by authenticated users to extract plaintext user ma…
    CVE-2026-23930 (CVSS 5.3) — An unauthenticated user is able to cause disproportionate CPU load on the Frontend webserver by sending specif…
    CVE-2026-23929 (CVSS 8.5) — Prototype pollution vulnerability in searchParamsToObject() is leading to a persistent XSS in Maps. URL parame…
    CVE-2026-1199 (CVSS 6.9) — Zabbix API and Frontend login lockout mechanism has a flaw where several unsuccessful login requests are not p…

    References

    http://git.zabbixzone.com/zabbix2.0/.git/commitdiff/333a3a5542ba8a2c901c24b7bf5440f41f1f4f54
    http://osvdb.org/84127
    http://secunia.com/advisories/49809
    http://secunia.com/advisories/50475
    http://www.debian.org/security/2012/dsa-2539
    http://www.exploit-db.com/exploits/20087
    http://www.openwall.com/lists/oss-security/2012/07/27/6
    http://www.openwall.com/lists/oss-security/2012/07/28/3
    http://www.securityfocus.com/bid/54661
    https://exchange.xforce.ibmcloud.com/vulnerabilities/77195
    https://support.zabbix.com/browse/ZBX-5348
    http://git.zabbixzone.com/zabbix2.0/.git/commitdiff/333a3a5542ba8a2c901c24b7bf5440f41f1f4f54
    http://osvdb.org/84127
    http://secunia.com/advisories/49809
    http://secunia.com/advisories/50475
    http://www.debian.org/security/2012/dsa-2539
    http://www.exploit-db.com/exploits/20087
    http://www.openwall.com/lists/oss-security/2012/07/27/6
    http://www.openwall.com/lists/oss-security/2012/07/28/3
    http://www.securityfocus.com/bid/54661
    https://exchange.xforce.ibmcloud.com/vulnerabilities/77195
    https://support.zabbix.com/browse/ZBX-5348

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High