Vulnerability description:
zabbix is an open source enterprise-level performance monitoring solution. Recently, the profileIdx2 parameter of zabbix jsrpc has a SQL injection vulnerability in insert mode. Attackers can log in to the zabbix management system without authorization, and can also directly obtain the operating system permissions of the zabbix server through functions such as script.
Affected version: 2.2.x, 3.0.0-3.0.3
Vulnerability level: high risk
Repair suggestions:
1. Upgrade to the latest version as soon as possible. The vulnerability has been fixed in versions above 3.0.4.
2. Use Baidu Cloud to accelerate WAF firewall for defense.
3. Add a website to the cloud observation, and learn about sudden/0day vulnerabilities in website components in time.
(Source: Guo Shenghua WeChat public account)