NetSight
IP …
high7.5Public exploit code

CVE-2009-4499

SQL injection vulnerability in the get_history_lastid function in the nodewatcher component in Zabbix Server before 1.6.8 allows remote attackers to execute ar…

Public exploit code

Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.

Impact

SQL injection vulnerability in the get_history_lastid function in the nodewatcher component in Zabbix Server before 1.6.8 allows remote attackers to execute arbitrary SQL commands via a crafted request, possibly related to the send_history_last_id function in zabbix_server/trapper/nodehistory.c.

Affected products

VendorProductAffected versions
ZabbixZabbix
through 1.6.7
Versions 1.1.2, 1.1.3, 1.1.4, 1.1.5, 1.4.2

Weakness classification

CWE-89

References