CVE-2024-22120

Time Based SQL Injection in Zabbix Server Audit Log

CVSS 9.1 CRITICALEPSS 76.6%CWE-20

Zabbix server can perform command execution for configured scripts. After command is executed, audit entry is added to "Audit Log". Due to "clientip" field is not sanitized, it is possible to injection SQL into "clientip" and exploit time based blind SQL injection.

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Produtos afetados

Zabbix · Zabbix

PoCs públicas encontradas — 4

githubgithub.com/W01fh4cker/CVE-2024-22120-RCE★ 140 githubgithub.com/isPique/CVE-2024-22120-RCE-with-gopher★ 3 githubgithub.com/g4nkd/CVE-2024-22120-RCE-with-gopher★ 3 githubgithub.com/darkbytehunter/CVE-2024-22120-RCE-with-gopher★ 1

⚠ Recursos públicos, para você avaliar a exposição de sistemas que controla ou está autorizado a testar. Teste apenas com autorização.

Quer saber se a sua infraestrutura está exposta a isto?

Falar com a TrueHacking →

Referências

https://support.zabbix.com/browse/ZBX-24505