Test ID:	1.3.6.1.4.1.25623.1.0.106545
Category:	Web application abuses
Title:	Zabbix Arbitrary Code Execution Vulnerability (CVE-2016-4338)
Summary:	Zabbix is prone to an arbitrary code execution vulnerability.
Description:	Summary: Zabbix is prone to an arbitrary code execution vulnerability. Vulnerability Insight: The mysql user parameter configuration script (userparameter_mysql.conf), when used with a shell other than bash, allows context-dependent attackers to execute arbitrary code or SQL commands via the mysql.size parameter. Affected Software/OS: Zabbix version prior to 2.0.18, 2.2.x and 3.0.x. Solution: Update to 2.0.18, 2.2.13, 3.0.3 or later. CVSS Score: 6.8 CVSS Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P
Cross-Ref:	Common Vulnerability Exposure (CVE) ID: CVE-2016-4338 BugTraq ID: 89631 http://www.securityfocus.com/bid/89631 Bugtraq: 20160503 CVE-2016-4338: Zabbix Agent 3.0.1 mysql.size shell command injection (Google Search) http://www.securityfocus.com/archive/1/538258/100/0/threaded https://www.exploit-db.com/exploits/39769/ http://seclists.org/fulldisclosure/2016/May/9 https://security.gentoo.org/glsa/201612-42 http://packetstormsecurity.com/files/136898/Zabbix-Agent-3.0.1-mysql.size-Shell-Command-Injection.html
Copyright	Copyright (C) 2017 Greenbone Networks GmbH

This is only one of 145615 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.