sql injection in zabbix front ends

[[email protected]]

Hi all,

While going through the code we have found there is lot of code prone to sql injection vulnerability. Eg:

Line 458 of db.inc.php invokes a SQL query built using unvalidated input. This call could allow an attacker to modify the statement's meaning or to execute arbitrary SQL The line no 185 to 188 from users.php has a variable called $_REQUEST['refresh']()

187 $_REQUEST['lang'],$_REQUEST['theme'],$_REQUEST['refresh'],$_REQUEST['user_type'],

whic is sinked with phjp file db.inc.php: on line 458

458 $result=mysql_query(trim($query),$DB['DB']);

There are lots of this kind How do we fix this ?

[Calimero]

As far as I remember _REQUEST and other special arrays are checked/cleaned before they are used.

Of course if you can actually inject SQL statements you should create and bug report on support.zabbix.com or quickly contact Zabbix SIA (private message on forum to Alexei or email).

[Aly]

Hi all,

While going through the code we have found there is lot of code prone to sql injection vulnerability. Eg:

Line 458 of db.inc.php invokes a SQL query built using unvalidated input. This call could allow an attacker to modify the statement's meaning or to execute arbitrary SQL The line no 185 to 188 from users.php has a variable called $_REQUEST['refresh']()

187 $_REQUEST['lang'],$_REQUEST['theme'],$_REQUEST['refresh'],$_REQUEST['user_type'],

whic is sinked with phjp file db.inc.php: on line 458

458 $result=mysql_query(trim($query),$DB['DB']);

There are lots of this kind How do we fix this ?

Did you really found(checked) SQL injection?? or you just assume?
I bet it's second..

[[email protected]]

There is a Tool called Fortify which can detect the SQL injections inside the code.Based on this Report i am asking this question

[Aly]

As Calimero said, zabbix checks incoming data.