Re: CVE Request: Zabbix: SQL injection vulnerabilities in "Latest data"

[<cve-assign () mitre org>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

> failure to sanitize input in the toggle_ids
> array in the latest.php page.

> https://support.zabbix.com/browse/ZBX-11023
> https://bugs.debian.org/850936

Use CVE-2016-10134.

The scope of this CVE does not include the "2016 Sep 07 18:41" comment
of "could it be that jsrpc.php was affected, too ? if so, the
changelog entry should probably be changed to either include all
affected endpoints, or at least not exclusively mention latest data."
If there is an exploitable problem other than with the
latest.php?toggle_ids[]= attack vector, then it should have a separate
CVE ID.

- -- 
CVE Assignment Team
M/S M300, 202 Burlington Road, Bedford, MA 01730 USA
[ A PGP key is available for encrypted communications at
  http://cve.mitre.org/cve/request_id.html ]
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQIcBAEBCAAGBQJYeEEHAAoJEHb/MwWLVhi2wiQQAIoA6FoGK0U52GblRjFJb0qJ
soeC2NSeZjhWpg+Dani9mXeU1gN0RoGC1W07vw0J/NFlAqlFU0CzqwUnP1mZEYjQ
u/aRgtwg4w4m1RgBb6amqFPSzsr5J1QzXy8F5siG8mEjjECNWBIpnILZxmW0dB+3
1NJIBlFVLahL8XFvT2RO4FD0EwORoB7gOrjF2Xu9kmVdHcMRk+QLHV/rnrbsDvUu
pqaYZF5qfbkZe4rsoPNFtjAOXroLJZu8GDoqVIORZykrVtD15ZVHpLBi9UCKEX9s
/98rfaOg5QAhqgPz+jGQhjegHb8xGOiy92ABfSSzF+9QMxIC/Jpuh88NIJQz4MUZ
Te0GIzoh+LFhlqyEc+eVPfZPvwlfM3XI//lPUZ+C4A0ottLFqYrBN0MGZWHLpYuF
kUugUMSg4Y5oHt8jeA0EH/rGQjryAr7knOr8y9p9w6j8cveE9ccFpCWFUnL0hH1k
QGJTEJmmEpBZMk2we0XMsw3HpCCeezo6j2mnjiExNhSnkKm+t2ggw5w5EEc01zH7
wAQnJnfyND8axxGGLFXJfYhwGV1jGnqxz4aIoLBsfrCPjbtCWLv47FZEZ8A1LxIr
Zj88Js9+iWOEWpOGK1ZkUVkW081cANaVjJQRFx6drTQD55hOZm3PqhSW2pfzA5K5
nf24yUXhAvv/RNu+Cgwc
=zHnG
-----END PGP SIGNATURE-----