Critical · published November 27, 2024
CVSS calls it critical at 9.9. It sits in the 99.6th percentile for exploit probability.
🔥 A single API call is the key to exploiting this SQL injection! In the Zabbix frontend, a non-admin user with any role granting API access can take advantage of a vulnerability hiding in plain sight. ⚡ Think of it like a delivery service that allows anyone with the right package label to request special deliveries — the system doesn't check who’s asking, and that can lead to chaos! An attacker could gain unauthorized access to sensitive data or manipulate the database, resulting in data leaks or even total control over the Zabbix instance. This could lead to catastrophic security breaches and loss of trust — absolutely devastating!
Think of it like a delivery service that allows anyone with the right package label to request special deliveries — the system doesn't check who’s asking, and that can lead to chaos! This SQL injection vulnerability exists in the CUser class, specifically in the addRelatedObjects function. This function is invoked by the CUser.get method, which is accessible to any user with API access, allowing attackers to run arbitrary SQL queries.
An attacker could gain unauthorized access to sensitive data or manipulate the database, resulting in data leaks or even total control over the Zabbix instance. This could lead to catastrophic security breaches and loss of trust — absolutely devastating! Patch Zabbix to version 6.2.4 or later immediately. Review API access permissions and restrict them to only necessary roles. Additionally, implement input validation and prepared statements to prevent SQL injection. 🛡️ You’ve got this! By taking these steps, you'll bolster your defenses and keep your Zabbix environment secure! 🚀