CVE-2022-23134 PoC — Possible view of the setup pages by unauthenticated users if config file already exists

Source

https://github.com/TheN00bBuilder/cve-2022-23134-poc-and-writeup

Associated Vulnerability

Title: Possible view of the setup pages by unauthenticated users if config file already exists (CVE-2022-23134)
Description:After the initial setup process, some steps of setup.php file are reachable not only by super-administrators, but by unauthenticated users as well. Malicious actor can pass step checks and potentially change the configuration of Zabbix Frontend.

Description

Writeup and POC for CVE-2022-23134

Readme

# CVE-2022-23134 Writeup and POC

This is a POC and writeup for CVE-2022-23134 in particular versions of Zabbix. Please read `writeup.md` on the details needed to use the exploit - it does require some setup of MySQL!

File Snapshot

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →