CVE-2022-23134
LOW KEV NUCLEIZabbix 5.4.0-5.4.7 - Unauthenticated Improper Access Control in Setup.php
Title source: llmExploitation Summary
CVE-2022-23134 is actively exploited and listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, added February 22, 2022. EIP tracks 1 public exploit from researchers including TheN00bBuilder. A Nuclei detection template is also available.
AI-analyzed exploit summary This PoC exploits CVE-2022-23134 in Zabbix by crafting a malicious cookie containing MySQL connection details, which is then sent to the vulnerable setup.php endpoint to achieve unauthorized database access.
Description
After the initial setup process, some steps of setup.php file are reachable not only by super-administrators, but by unauthenticated users as well. Malicious actor can pass step checks and potentially change the configuration of Zabbix Frontend.
Exploits (1)
This PoC exploits CVE-2022-23134 in Zabbix by crafting a malicious cookie containing MySQL connection details, which is then sent to the vulnerable setup.php endpoint to achieve unauthorized database access.
Nuclei Templates (1)
http.favicon.hash:892542951 || http.title:"zabbix-server" || cpe:"cpe:2.3:a:zabbix:zabbix"
icon_hash=892542951 || app="zabbix-监控系统" && body="saml" || title="zabbix-server"
References (5)
Scores
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N