A vulnerability has been reported in Zabbix, which can be exploited by malicious people to conduct SQL injection attacks.

Input passed via the "itemid" parameter to popup_bitem.php is not properly sanitised before being used in a SQL query. This can be exploited to manipulate SQL queries by injecting arbitrary SQL code.

The vulnerability is reported in versions 1.8.14 and 2.0.1. Other versions may also be affected.

Solution
Update to version 1.8.15 or 2.0.2.

Provided and/or discovered by
muts

Changelog
Further details available to Secunia VIM customers

Original Advisory
Zabbix:
https://support.zabbix.com/browse/ZBX-5348
http://git.zabbixzone.com/zabbix2.0/.git/commit/333a3a5542ba8a2c901c24b7bf5440f41f1f4f54
http://www.zabbix.com/rn1.8.15.php

muts:
http://www.exploit-db.com/exploits/20087/

Deep Links
Links available to Secunia VIM customers