Exploitation Summary
EIP tracks 2 public exploits for CVE-2013-5743.
PoCs published by Jason Kratzer, including Metasploit module exploits/linux/http/zabbix_sqli.
AI-analyzed exploit summary This Metasploit module exploits an unauthenticated SQL injection in Zabbix <= 2.0.8 to extract an admin session ID, then uploads and executes a malicious script via 'scripts_exec.php' for remote code execution.
Description
Multiple SQL injection vulnerabilities in Zabbix 1.8.x before 1.8.18rc1, 2.0.x before 2.0.9rc1, and 2.1.x before 2.1.7.
Exploits (2)
This Metasploit module exploits an unauthenticated SQL injection in Zabbix <= 2.0.8 to extract an admin session ID, then uploads and executes a malicious script via 'scripts_exec.php' for remote code execution.
This Metasploit module exploits an unauthenticated SQL injection vulnerability in Zabbix versions 2.0.8 and lower to retrieve an active session ID, then leverages it to upload and execute a malicious script via 'scripts_exec.php' for remote code execution.
References (4)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H