This Python script exploits a SQL injection vulnerability in Zabbix versions 2.0 to 3.0.3 by injecting malicious SQL queries into the 'profileIdx2' parameter. It extracts user credentials and session IDs from the database.
Classification
Working Poc 95%
Attack Type
Sqli
Complexity
Moderate
Reliability
Reliable
Target:Zabbix 2.0 to 3.0.3
No auth needed
Prerequisites:Network access to the Zabbix web interface · Zabbix version between 2.0 and 3.0.3