CVE-2016-10134

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

SQL injection vulnerability in Zabbix before 2.2.14 and 3.0 before 3.0.4 allows remote attackers to execute arbitrary SQL commands via the toggle_ids array parameter in latest.php.

Metrics

CVSS 3.0 9.8/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-89

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://www.debian.org/security/2017/dsa-3802
http://www.openwall.com/lists/oss-security/2017/01/12/4Mailing List, Third Party Advisory
http://www.openwall.com/lists/oss-security/2017/01/13/4Mailing List, Third Party Advisory
http://www.securityfocus.com/bid/95423Third Party Advisory, VDB Entry
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=850936Third Party Advisory
https://code610.blogspot.com/2017/10/zbx-11023-quick-autopsy.html
https://support.zabbix.com/browse/ZBX-11023Exploit, Patch, Vendor Advisory
http://www.debian.org/security/2017/dsa-3802
http://www.openwall.com/lists/oss-security/2017/01/12/4Mailing List, Third Party Advisory
http://www.openwall.com/lists/oss-security/2017/01/13/4Mailing List, Third Party Advisory
http://www.securityfocus.com/bid/95423Third Party Advisory, VDB Entry
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=850936Third Party Advisory
https://code610.blogspot.com/2017/10/zbx-11023-quick-autopsy.html
https://support.zabbix.com/browse/ZBX-11023Exploit, Patch, Vendor Advisory

Timeline

Published: Feb 17, 2017
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2016

CVE-2016-101355.5An issue was discovered on LG devices using the MTK chipset with L(5.0/5.1), M(6.0/6.0.1), and N(7.0) software, and RCA Voyager Tablet, BLU CVE-2016-101367.8An issue was discovered on BLU R1 HD devices with Shanghai Adups software. The content provider named com.adups.fota.sysoper.provider.InfoPr CVE-2016-101377.8An issue was discovered on BLU R1 HD devices with Shanghai Adups software. The content provider named com.adups.fota.sysoper.provider.InfoPr CVE-2016-101387.8An issue was discovered on BLU Advance 5.0 and BLU R1 HD devices with Shanghai Adups software. The com.adups.fota.sysoper app is installed a CVE-2016-101397.8An issue was discovered on BLU R1 HD devices with Shanghai Adups software. The two package names involved in the exfiltration are com.adups.CVE-2016-10147.3Untrusted search path vulnerability in Adobe Flash Player before 18.0.0.343 and 19.x through 21.x before 21.0.0.213 on Windows and OS X and CVE-2016-101407.5Information disclosure and authentication bypass vulnerability exists in the Apache HTTP Server configuration bundled with ZoneMinder v1.30 CVE-2016-101419.8An integer overflow vulnerability was observed in the regemit function in regexp.c in Artifex Software, Inc. MuJS before fa3d30fd18c348bb4b1 CVE-2016-101428.6An issue was discovered in the IPv6 protocol specification, related to ICMP Packet Too Big (PTB) messages. (The scope of this CVE is all aff CVE-2016-101437.5A vulnerability in Tiki Wiki CMS 15.2 could allow a remote attacker to read arbitrary files on a targeted system via a crafted pathname in a CVE-2016-101449.8coders/ipl.c in ImageMagick allows remote attackers to have unspecific impact by leveraging a missing malloc check.CVE-2016-101459.8Off-by-one error in coders/wpg.c in ImageMagick allows remote attackers to have unspecified impact via vectors related to a string copy.