CVE-2024-22120: Time Based SQL Injection in Zabbix Server Audit Log
Zabbix server can perform command execution for configured scripts. After command is executed, audit entry is added to "Audit Log". Due to "clientip" field is not sanitized, it is possible to injection SQL into "clientip" and exploit time based blind SQL injection.
Allows to dump any values from database. As an example of exploit above allows privilege escalation from user to admin. In some cases, SQL injection leads to RCE.
Description: https://support.zabbix.com/browse/ZBX-24505
Zabbix server can perform command execution for configured scripts. After command is executed, audit entry is added to "Audit Log". Due to "clientip" field is not sanitized, it is possible to injection SQL into "clientip" and exploit time based blind SQL injection.
Affected and fixed version/s:
* 6.0.0 - 6.0.27 / 6.0.28rc1
* 6.4.0 - 6.4.12 / 6.4.13rc1
* 7.0.0alpha1 - 7.0.0beta1 / 7.0.0beta2
Allows to dump any values from database. As an example of exploit above allows privilege escalation from user to admin. In some cases, SQL injection leads to RCE.
Description: https://support.zabbix.com/browse/ZBX-24505