CVE-2011-4674

Zabbix 1.8.3-1.8.4 - SQL Injection via only_hostid Parameter

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2011-4674. PoCs published by Marcio Almeida.

AI-analyzed exploit summary This is a detailed technical writeup for CVE-2011-4674, a SQL injection vulnerability in Zabbix <= 1.8.4. It includes the vulnerable code snippet, a proof-of-concept URL, and an analysis of the impact and affected systems.

Description

SQL injection vulnerability in popup.php in Zabbix 1.8.3 and 1.8.4, and possibly other versions before 1.8.9, allows remote attackers to execute arbitrary SQL commands via the only_hostid parameter.

Exploits (1)

exploitdb WRITEUP VERIFIED
by Marcio Almeida · textwebappsphp
https://www.exploit-db.com/exploits/18155

This is a detailed technical writeup for CVE-2011-4674, a SQL injection vulnerability in Zabbix <= 1.8.4. It includes the vulnerable code snippet, a proof-of-concept URL, and an analysis of the impact and affected systems.

Classification
Writeup 100%
Attack Type
Sqli
Complexity
Trivial
Reliability
Reliable
Target: Zabbix <= 1.8.4
No auth needed
Prerequisites: Access to the Zabbix web interface
devstral-2 · analyzed Feb 18, 2026 Full analysis →

References (4)

Core 4
Core References
Exploit exploit x_refsource_exploit-db
http://www.exploit-db.com/exploits/18155
Exploit x_refsource_confirm
https://support.zabbix.com/browse/ZBX-4385
Third Party Advisory, VDB Entry vdb-entry x_refsource_xf
https://exchange.xforce.ibmcloud.com/vulnerabilities/71479
Exploit vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/50803

Scores

EPSS 0.0255
EPSS Percentile 83.0%

Details

CWE
CWE-89
Status published
Products (2)
zabbix/zabbix 1.8.3
zabbix/zabbix 1.8.4
Published Dec 02, 2011
Tracked Since Feb 18, 2026