← CVE Intelligence

CVE-2024-22120

Time Based SQL Injection in Zabbix Server Audit Log PUBLISHED

Description (CNA)

Zabbix server can perform command execution for configured scripts. After command is executed, audit entry is added to "Audit Log". Due to "clientip" field is not sanitized, it is possible to injection SQL into "clientip" and exploit time based blind SQL injection.

Affected (CNA)

Vendor / productVersions
Zabbix / Zabbixaffected 6.0.0 through 6.0.27; affected 6.4.0 through 6.4.12; affected 7.0.0alpha1 through 7.0.0beta1

CWE

CWE-20

References

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.

CVE

No English description supplied.