CVE-2010-0712
Zenoss < 2.5 - Authenticated SQL Injection via Events API Parameters
Title source: llmExploitation Summary
EIP tracks 1 public exploit for CVE-2010-0712. PoCs published by nGenuity Information Services.
AI-analyzed exploit summary This exploit demonstrates a SQL injection vulnerability in Zenoss 2.3.3 by injecting a malicious SQL query into the 'getJSONEventsInfo' endpoint, potentially allowing an attacker to write arbitrary data to a file on the server.
Description
Multiple SQL injection vulnerabilities in zport/dmd/Events/getJSONEventsInfo in Zenoss 2.3.3, and other versions before 2.5, allow remote authenticated users to execute arbitrary SQL commands via the (1) severity, (2) state, (3) filter, (4) offset, and (5) count parameters.
Exploits (1)
This exploit demonstrates a SQL injection vulnerability in Zenoss 2.3.3 by injecting a malicious SQL query into the 'getJSONEventsInfo' endpoint, potentially allowing an attacker to write arbitrary data to a file on the server.