Read the docs
TI-2012-02964 Aliases CVE-2012-3435GHSA-w8xh-986v-xwgh

SQL injection vulnerability in frontends/php/popup_bitem.php in Zabbix 1.8.15rc1 and…

Priority LOW 39CWE-89Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
— Not recorded in CVSS 2.0
Attack complexity
Low
Impact type
SQL injection
Confidentiality · integrity · availability
Partial · Partial · Partial
Fix status
No fix listed

Attack profile from CVSS 2.0 · NVD. Fix status from CNA. Impact type from CWE-89.

Summary

SQL injection vulnerability in frontends/php/popup_bitem.php in Zabbix 1.8.15rc1 and earlier, and 2.x before 2.0.2rc1, allows remote attackers to execute arbitrary SQL commands via the itemid parameter.

Why it matters now

EPSS 0.0358 89th percentileScored 2026-11-07
Public exploit Yes 2 exploit referencesTagged by the CNA and NVD
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 70

CPEVersionsRoleVendor
cpe:2.3:a:zabbix:zabbix:*:rc1:*:*:*:*:*:*up to 1.8.15VulnerableZabbix
cpe:2.3:a:zabbix:zabbix:1.1:*:*:*:*:*:*:*1.1VulnerableZabbix
cpe:2.3:a:zabbix:zabbix:1.1:beta10:*:*:*:*:*:*1.1 beta10VulnerableZabbix
cpe:2.3:a:zabbix:zabbix:1.1:beta11:*:*:*:*:*:*1.1 beta11VulnerableZabbix
cpe:2.3:a:zabbix:zabbix:1.1:beta12:*:*:*:*:*:*1.1 beta12VulnerableZabbix
cpe:2.3:a:zabbix:zabbix:1.1:beta2:*:*:*:*:*:*1.1 beta2VulnerableZabbix
cpe:2.3:a:zabbix:zabbix:1.1:beta3:*:*:*:*:*:*1.1 beta3VulnerableZabbix
cpe:2.3:a:zabbix:zabbix:1.1:beta4:*:*:*:*:*:*1.1 beta4VulnerableZabbix
cpe:2.3:a:zabbix:zabbix:1.1:beta5:*:*:*:*:*:*1.1 beta5VulnerableZabbix
cpe:2.3:a:zabbix:zabbix:1.1:beta6:*:*:*:*:*:*1.1 beta6VulnerableZabbix
  • cpe:2.3:a:zabbix:zabbix:*:rc1:*:*:*:*:*:* Versions up to 1.8.15 Vulnerable ·Zabbix
  • cpe:2.3:a:zabbix:zabbix:1.1:*:*:*:*:*:*:* Versions 1.1 Vulnerable ·Zabbix
  • cpe:2.3:a:zabbix:zabbix:1.1:beta10:*:*:*:*:*:* Versions 1.1 beta10 Vulnerable ·Zabbix
  • cpe:2.3:a:zabbix:zabbix:1.1:beta11:*:*:*:*:*:* Versions 1.1 beta11 Vulnerable ·Zabbix
  • cpe:2.3:a:zabbix:zabbix:1.1:beta12:*:*:*:*:*:* Versions 1.1 beta12 Vulnerable ·Zabbix
  • cpe:2.3:a:zabbix:zabbix:1.1:beta2:*:*:*:*:*:* Versions 1.1 beta2 Vulnerable ·Zabbix
  • cpe:2.3:a:zabbix:zabbix:1.1:beta3:*:*:*:*:*:* Versions 1.1 beta3 Vulnerable ·Zabbix
  • cpe:2.3:a:zabbix:zabbix:1.1:beta4:*:*:*:*:*:* Versions 1.1 beta4 Vulnerable ·Zabbix
  • cpe:2.3:a:zabbix:zabbix:1.1:beta5:*:*:*:*:*:* Versions 1.1 beta5 Vulnerable ·Zabbix
  • cpe:2.3:a:zabbix:zabbix:1.1:beta6:*:*:*:*:*:* Versions 1.1 beta6 Vulnerable ·Zabbix
Show 60 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:zabbix:zabbix:1.1:beta7:*:*:*:*:*:*1.1 beta7VulnerableZabbix
cpe:2.3:a:zabbix:zabbix:1.1:beta8:*:*:*:*:*:*1.1 beta8VulnerableZabbix
cpe:2.3:a:zabbix:zabbix:1.1:beta9:*:*:*:*:*:*1.1 beta9VulnerableZabbix
cpe:2.3:a:zabbix:zabbix:1.1.1:*:*:*:*:*:*:*1.1.1VulnerableZabbix
cpe:2.3:a:zabbix:zabbix:1.1.2:*:*:*:*:*:*:*1.1.2VulnerableZabbix
cpe:2.3:a:zabbix:zabbix:1.1.3:*:*:*:*:*:*:*1.1.3VulnerableZabbix
cpe:2.3:a:zabbix:zabbix:1.1.4:*:*:*:*:*:*:*1.1.4VulnerableZabbix
cpe:2.3:a:zabbix:zabbix:1.1.5:*:*:*:*:*:*:*1.1.5VulnerableZabbix
cpe:2.3:a:zabbix:zabbix:1.1.6:*:*:*:*:*:*:*1.1.6VulnerableZabbix
cpe:2.3:a:zabbix:zabbix:1.1.7:*:*:*:*:*:*:*1.1.7VulnerableZabbix
cpe:2.3:a:zabbix:zabbix:1.3:beta:*:*:*:*:*:*1.3 betaVulnerableZabbix
cpe:2.3:a:zabbix:zabbix:1.3.1:beta:*:*:*:*:*:*1.3.1 betaVulnerableZabbix
cpe:2.3:a:zabbix:zabbix:1.3.2:beta:*:*:*:*:*:*1.3.2 betaVulnerableZabbix
cpe:2.3:a:zabbix:zabbix:1.3.3:beta:*:*:*:*:*:*1.3.3 betaVulnerableZabbix
cpe:2.3:a:zabbix:zabbix:1.3.4:beta:*:*:*:*:*:*1.3.4 betaVulnerableZabbix
cpe:2.3:a:zabbix:zabbix:1.3.5:beta:*:*:*:*:*:*1.3.5 betaVulnerableZabbix
cpe:2.3:a:zabbix:zabbix:1.3.6:beta:*:*:*:*:*:*1.3.6 betaVulnerableZabbix
cpe:2.3:a:zabbix:zabbix:1.3.7:beta:*:*:*:*:*:*1.3.7 betaVulnerableZabbix
cpe:2.3:a:zabbix:zabbix:1.3.8:beta:*:*:*:*:*:*1.3.8 betaVulnerableZabbix
cpe:2.3:a:zabbix:zabbix:1.4.2:*:*:*:*:*:*:*1.4.2VulnerableZabbix
cpe:2.3:a:zabbix:zabbix:1.4.3:*:*:*:*:*:*:*1.4.3VulnerableZabbix
cpe:2.3:a:zabbix:zabbix:1.4.4:*:*:*:*:*:*:*1.4.4VulnerableZabbix
cpe:2.3:a:zabbix:zabbix:1.4.5:*:*:*:*:*:*:*1.4.5VulnerableZabbix
cpe:2.3:a:zabbix:zabbix:1.4.6:*:*:*:*:*:*:*1.4.6VulnerableZabbix
cpe:2.3:a:zabbix:zabbix:1.5:beta:*:*:*:*:*:*1.5 betaVulnerableZabbix
cpe:2.3:a:zabbix:zabbix:1.5.1:beta:*:*:*:*:*:*1.5.1 betaVulnerableZabbix
cpe:2.3:a:zabbix:zabbix:1.5.2:beta:*:*:*:*:*:*1.5.2 betaVulnerableZabbix
cpe:2.3:a:zabbix:zabbix:1.5.3:beta:*:*:*:*:*:*1.5.3 betaVulnerableZabbix
cpe:2.3:a:zabbix:zabbix:1.5.4:beta:*:*:*:*:*:*1.5.4 betaVulnerableZabbix
cpe:2.3:a:zabbix:zabbix:1.6:*:*:*:*:*:*:*1.6VulnerableZabbix
cpe:2.3:a:zabbix:zabbix:1.6.1:*:*:*:*:*:*:*1.6.1VulnerableZabbix
cpe:2.3:a:zabbix:zabbix:1.6.2:*:*:*:*:*:*:*1.6.2VulnerableZabbix
cpe:2.3:a:zabbix:zabbix:1.6.3:*:*:*:*:*:*:*1.6.3VulnerableZabbix
cpe:2.3:a:zabbix:zabbix:1.6.4:*:*:*:*:*:*:*1.6.4VulnerableZabbix
cpe:2.3:a:zabbix:zabbix:1.6.5:*:*:*:*:*:*:*1.6.5VulnerableZabbix
cpe:2.3:a:zabbix:zabbix:1.6.6:*:*:*:*:*:*:*1.6.6VulnerableZabbix
cpe:2.3:a:zabbix:zabbix:1.6.7:*:*:*:*:*:*:*1.6.7VulnerableZabbix
cpe:2.3:a:zabbix:zabbix:1.6.8:*:*:*:*:*:*:*1.6.8VulnerableZabbix
cpe:2.3:a:zabbix:zabbix:1.6.9:*:*:*:*:*:*:*1.6.9VulnerableZabbix
cpe:2.3:a:zabbix:zabbix:1.7:*:*:*:*:*:*:*1.7VulnerableZabbix
cpe:2.3:a:zabbix:zabbix:1.7.1:*:*:*:*:*:*:*1.7.1VulnerableZabbix
cpe:2.3:a:zabbix:zabbix:1.7.2:*:*:*:*:*:*:*1.7.2VulnerableZabbix
cpe:2.3:a:zabbix:zabbix:1.7.3:*:*:*:*:*:*:*1.7.3VulnerableZabbix
cpe:2.3:a:zabbix:zabbix:1.7.4:*:*:*:*:*:*:*1.7.4VulnerableZabbix
cpe:2.3:a:zabbix:zabbix:1.8:*:*:*:*:*:*:*1.8VulnerableZabbix
cpe:2.3:a:zabbix:zabbix:1.8.1:*:*:*:*:*:*:*1.8.1VulnerableZabbix
cpe:2.3:a:zabbix:zabbix:1.8.2:*:*:*:*:*:*:*1.8.2VulnerableZabbix
cpe:2.3:a:zabbix:zabbix:1.8.3:rc1:*:*:*:*:*:*1.8.3 rc1VulnerableZabbix
cpe:2.3:a:zabbix:zabbix:1.8.3:rc2:*:*:*:*:*:*1.8.3 rc2VulnerableZabbix
cpe:2.3:a:zabbix:zabbix:1.8.3:rc3:*:*:*:*:*:*1.8.3 rc3VulnerableZabbix
cpe:2.3:a:zabbix:zabbix:2.0.0:*:*:*:*:*:*:*2.0.0VulnerableZabbix
cpe:2.3:a:zabbix:zabbix:2.0.0:rc1:*:*:*:*:*:*2.0.0 rc1VulnerableZabbix
cpe:2.3:a:zabbix:zabbix:2.0.0:rc2:*:*:*:*:*:*2.0.0 rc2VulnerableZabbix
cpe:2.3:a:zabbix:zabbix:2.0.0:rc3:*:*:*:*:*:*2.0.0 rc3VulnerableZabbix
cpe:2.3:a:zabbix:zabbix:2.0.0:rc4:*:*:*:*:*:*2.0.0 rc4VulnerableZabbix
cpe:2.3:a:zabbix:zabbix:2.0.0:rc5:*:*:*:*:*:*2.0.0 rc5VulnerableZabbix
cpe:2.3:a:zabbix:zabbix:2.0.0:rc6:*:*:*:*:*:*2.0.0 rc6VulnerableZabbix
cpe:2.3:a:zabbix:zabbix:2.0.1:*:*:*:*:*:*:*2.0.1VulnerableZabbix
cpe:2.3:a:zabbix:zabbix:2.0.1:rc1:*:*:*:*:*:*2.0.1 rc1VulnerableZabbix
cpe:2.3:a:zabbix:zabbix:2.0.1:rc2:*:*:*:*:*:*2.0.1 rc2VulnerableZabbix
  • cpe:2.3:a:zabbix:zabbix:1.1:beta7:*:*:*:*:*:* Versions 1.1 beta7 Vulnerable ·Zabbix
  • cpe:2.3:a:zabbix:zabbix:1.1:beta8:*:*:*:*:*:* Versions 1.1 beta8 Vulnerable ·Zabbix
  • cpe:2.3:a:zabbix:zabbix:1.1:beta9:*:*:*:*:*:* Versions 1.1 beta9 Vulnerable ·Zabbix
  • cpe:2.3:a:zabbix:zabbix:1.1.1:*:*:*:*:*:*:* Versions 1.1.1 Vulnerable ·Zabbix
  • cpe:2.3:a:zabbix:zabbix:1.1.2:*:*:*:*:*:*:* Versions 1.1.2 Vulnerable ·Zabbix
  • cpe:2.3:a:zabbix:zabbix:1.1.3:*:*:*:*:*:*:* Versions 1.1.3 Vulnerable ·Zabbix
  • cpe:2.3:a:zabbix:zabbix:1.1.4:*:*:*:*:*:*:* Versions 1.1.4 Vulnerable ·Zabbix
  • cpe:2.3:a:zabbix:zabbix:1.1.5:*:*:*:*:*:*:* Versions 1.1.5 Vulnerable ·Zabbix
  • cpe:2.3:a:zabbix:zabbix:1.1.6:*:*:*:*:*:*:* Versions 1.1.6 Vulnerable ·Zabbix
  • cpe:2.3:a:zabbix:zabbix:1.1.7:*:*:*:*:*:*:* Versions 1.1.7 Vulnerable ·Zabbix
  • cpe:2.3:a:zabbix:zabbix:1.3:beta:*:*:*:*:*:* Versions 1.3 beta Vulnerable ·Zabbix
  • cpe:2.3:a:zabbix:zabbix:1.3.1:beta:*:*:*:*:*:* Versions 1.3.1 beta Vulnerable ·Zabbix
  • cpe:2.3:a:zabbix:zabbix:1.3.2:beta:*:*:*:*:*:* Versions 1.3.2 beta Vulnerable ·Zabbix
  • cpe:2.3:a:zabbix:zabbix:1.3.3:beta:*:*:*:*:*:* Versions 1.3.3 beta Vulnerable ·Zabbix
  • cpe:2.3:a:zabbix:zabbix:1.3.4:beta:*:*:*:*:*:* Versions 1.3.4 beta Vulnerable ·Zabbix
  • cpe:2.3:a:zabbix:zabbix:1.3.5:beta:*:*:*:*:*:* Versions 1.3.5 beta Vulnerable ·Zabbix
  • cpe:2.3:a:zabbix:zabbix:1.3.6:beta:*:*:*:*:*:* Versions 1.3.6 beta Vulnerable ·Zabbix
  • cpe:2.3:a:zabbix:zabbix:1.3.7:beta:*:*:*:*:*:* Versions 1.3.7 beta Vulnerable ·Zabbix
  • cpe:2.3:a:zabbix:zabbix:1.3.8:beta:*:*:*:*:*:* Versions 1.3.8 beta Vulnerable ·Zabbix
  • cpe:2.3:a:zabbix:zabbix:1.4.2:*:*:*:*:*:*:* Versions 1.4.2 Vulnerable ·Zabbix
  • cpe:2.3:a:zabbix:zabbix:1.4.3:*:*:*:*:*:*:* Versions 1.4.3 Vulnerable ·Zabbix
  • cpe:2.3:a:zabbix:zabbix:1.4.4:*:*:*:*:*:*:* Versions 1.4.4 Vulnerable ·Zabbix
  • cpe:2.3:a:zabbix:zabbix:1.4.5:*:*:*:*:*:*:* Versions 1.4.5 Vulnerable ·Zabbix
  • cpe:2.3:a:zabbix:zabbix:1.4.6:*:*:*:*:*:*:* Versions 1.4.6 Vulnerable ·Zabbix
  • cpe:2.3:a:zabbix:zabbix:1.5:beta:*:*:*:*:*:* Versions 1.5 beta Vulnerable ·Zabbix
  • cpe:2.3:a:zabbix:zabbix:1.5.1:beta:*:*:*:*:*:* Versions 1.5.1 beta Vulnerable ·Zabbix
  • cpe:2.3:a:zabbix:zabbix:1.5.2:beta:*:*:*:*:*:* Versions 1.5.2 beta Vulnerable ·Zabbix
  • cpe:2.3:a:zabbix:zabbix:1.5.3:beta:*:*:*:*:*:* Versions 1.5.3 beta Vulnerable ·Zabbix
  • cpe:2.3:a:zabbix:zabbix:1.5.4:beta:*:*:*:*:*:* Versions 1.5.4 beta Vulnerable ·Zabbix
  • cpe:2.3:a:zabbix:zabbix:1.6:*:*:*:*:*:*:* Versions 1.6 Vulnerable ·Zabbix
  • cpe:2.3:a:zabbix:zabbix:1.6.1:*:*:*:*:*:*:* Versions 1.6.1 Vulnerable ·Zabbix
  • cpe:2.3:a:zabbix:zabbix:1.6.2:*:*:*:*:*:*:* Versions 1.6.2 Vulnerable ·Zabbix
  • cpe:2.3:a:zabbix:zabbix:1.6.3:*:*:*:*:*:*:* Versions 1.6.3 Vulnerable ·Zabbix
  • cpe:2.3:a:zabbix:zabbix:1.6.4:*:*:*:*:*:*:* Versions 1.6.4 Vulnerable ·Zabbix
  • cpe:2.3:a:zabbix:zabbix:1.6.5:*:*:*:*:*:*:* Versions 1.6.5 Vulnerable ·Zabbix
  • cpe:2.3:a:zabbix:zabbix:1.6.6:*:*:*:*:*:*:* Versions 1.6.6 Vulnerable ·Zabbix
  • cpe:2.3:a:zabbix:zabbix:1.6.7:*:*:*:*:*:*:* Versions 1.6.7 Vulnerable ·Zabbix
  • cpe:2.3:a:zabbix:zabbix:1.6.8:*:*:*:*:*:*:* Versions 1.6.8 Vulnerable ·Zabbix
  • cpe:2.3:a:zabbix:zabbix:1.6.9:*:*:*:*:*:*:* Versions 1.6.9 Vulnerable ·Zabbix
  • cpe:2.3:a:zabbix:zabbix:1.7:*:*:*:*:*:*:* Versions 1.7 Vulnerable ·Zabbix
  • cpe:2.3:a:zabbix:zabbix:1.7.1:*:*:*:*:*:*:* Versions 1.7.1 Vulnerable ·Zabbix
  • cpe:2.3:a:zabbix:zabbix:1.7.2:*:*:*:*:*:*:* Versions 1.7.2 Vulnerable ·Zabbix
  • cpe:2.3:a:zabbix:zabbix:1.7.3:*:*:*:*:*:*:* Versions 1.7.3 Vulnerable ·Zabbix
  • cpe:2.3:a:zabbix:zabbix:1.7.4:*:*:*:*:*:*:* Versions 1.7.4 Vulnerable ·Zabbix
  • cpe:2.3:a:zabbix:zabbix:1.8:*:*:*:*:*:*:* Versions 1.8 Vulnerable ·Zabbix
  • cpe:2.3:a:zabbix:zabbix:1.8.1:*:*:*:*:*:*:* Versions 1.8.1 Vulnerable ·Zabbix
  • cpe:2.3:a:zabbix:zabbix:1.8.2:*:*:*:*:*:*:* Versions 1.8.2 Vulnerable ·Zabbix
  • cpe:2.3:a:zabbix:zabbix:1.8.3:rc1:*:*:*:*:*:* Versions 1.8.3 rc1 Vulnerable ·Zabbix
  • cpe:2.3:a:zabbix:zabbix:1.8.3:rc2:*:*:*:*:*:* Versions 1.8.3 rc2 Vulnerable ·Zabbix
  • cpe:2.3:a:zabbix:zabbix:1.8.3:rc3:*:*:*:*:*:* Versions 1.8.3 rc3 Vulnerable ·Zabbix
  • cpe:2.3:a:zabbix:zabbix:2.0.0:*:*:*:*:*:*:* Versions 2.0.0 Vulnerable ·Zabbix
  • cpe:2.3:a:zabbix:zabbix:2.0.0:rc1:*:*:*:*:*:* Versions 2.0.0 rc1 Vulnerable ·Zabbix
  • cpe:2.3:a:zabbix:zabbix:2.0.0:rc2:*:*:*:*:*:* Versions 2.0.0 rc2 Vulnerable ·Zabbix
  • cpe:2.3:a:zabbix:zabbix:2.0.0:rc3:*:*:*:*:*:* Versions 2.0.0 rc3 Vulnerable ·Zabbix
  • cpe:2.3:a:zabbix:zabbix:2.0.0:rc4:*:*:*:*:*:* Versions 2.0.0 rc4 Vulnerable ·Zabbix
  • cpe:2.3:a:zabbix:zabbix:2.0.0:rc5:*:*:*:*:*:* Versions 2.0.0 rc5 Vulnerable ·Zabbix
  • cpe:2.3:a:zabbix:zabbix:2.0.0:rc6:*:*:*:*:*:* Versions 2.0.0 rc6 Vulnerable ·Zabbix
  • cpe:2.3:a:zabbix:zabbix:2.0.1:*:*:*:*:*:*:* Versions 2.0.1 Vulnerable ·Zabbix
  • cpe:2.3:a:zabbix:zabbix:2.0.1:rc1:*:*:*:*:*:* Versions 2.0.1 rc1 Vulnerable ·Zabbix
  • cpe:2.3:a:zabbix:zabbix:2.0.1:rc2:*:*:*:*:*:* Versions 2.0.1 rc2 Vulnerable ·Zabbix

Remediation

No fixed version listed by the sources yet.

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat

Timeline

  1. 2026-10-02 Threatist record created from CVE-2012-3435
  2. 2026-10-03 Alias added: GHSA-w8xh-986v-xwgh

References

  • TI-2022-07300 Authentication bypass by spoofing in Zabbix Frontend KEVCVSS 3.1CRITICAL 9.8
  • TI-2024-28315 SQL injection in user.get API CVSS 3.1CRITICAL 9.9
  • TI-2016-08210 SQL injection vulnerability in Zabbix before 2.2.14 and 3.0 before 3.0.4 allows remote… CVSS 3.0CRITICAL 9.8
  • TI-2013-04884 Multiple SQL injection vulnerabilities in Zabbix 1.8.x before 1.8.18rc1, 2.0.x before 2.0.9rc1, and 2.1.x before 2.1.7. CVSS 3.1CRITICAL 9.8
  • TI-2022-07303 Possible view of the setup pages by unauthenticated users if config file already exists KEVCVSS 3.1MEDIUM 5.3
  • TI-2024-14721 Time Based SQL Injection in Zabbix Server Audit Log CVSS 3.1CRITICAL 9.1
See all 114 →

Sources