CVE-2010-1277

Severity: high (CVSS 7.5 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.7% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2010-04-06 · updated 2026-06-16
Weakness: CWE-89

Description

SQL injection vulnerability in the user.authenticate method in the API in Zabbix 1.8 before 1.8.2 allows remote attackers to execute arbitrary SQL commands via the user parameter in JSON data to api_jsonrpc.php.

Affected products

Zabbix: 1.8, 1.8.1

References

http://archives.neohapsis.com/archives/fulldisclosure/2010-04/0001.html
http://legalhackers.com/advisories/zabbix181api-sql.txt
http://legalhackers.com/poc/zabbix181api.pl-poc
http://secunia.com/advisories/39119
http://www.osvdb.org/63456
http://www.securityfocus.com/archive/1/510480/100/0/threaded
http://www.securityfocus.com/bid/39148
http://www.vupen.com/english/advisories/2010/0799
http://www.zabbix.com/rn1.8.2.php
http://archives.neohapsis.com/archives/fulldisclosure/2010-04/0001.html
http://legalhackers.com/advisories/zabbix181api-sql.txt
http://legalhackers.com/poc/zabbix181api.pl-poc

Get alerted when CVE-2010-1277 or the next vulnerability affects your stack