{"answers":{"affected":"It affects 1 product.","exploited":"It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-22120 exists.","fix":"Apply the vendor's patch.","what":"CVE-2024-22120 is a critical SQL injection vulnerability in Zabbix Zabbix, published on 17 May 2024. An attacker needs administrator access to exploit it, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2024-22120 and fix it if it is affected.\n\nWhat it is: CVE-2024-22120 is a critical SQL injection vulnerability in Zabbix Zabbix, published on 17 May 2024. An attacker needs administrator access to exploit it, with no action from the victim.\nExploitation: It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-22120 exists.\n\nAffected product: Zabbix Zabbix. No package-level version data is available, so check the vendor advisory linked from the reference page.\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2024-22120/ (Markdown: https://insights.sbomify.com/CVE-2024-22120/index.md)","id":"CVE-2024-22120","markdown":"https://insights.sbomify.com/CVE-2024-22120/index.md","name":"CVE-2024-22120","record":{"aliases":["DEBIAN-CVE-2024-22120","GHSA-625f-58w6-wj9f","UBUNTU-CVE-2024-22120"],"analysis":{"component_type":"server_software","fix_type":"patch","impacts":["data_read"],"network_reachable":"yes","non_default_config":false,"product_category":"Zabbix monitoring server","requires_auth":"high_privilege","summary":"Attackers can exploit unsanitized client IP fields in Zabbix audit logs to perform time-based blind SQL injection, potentially reading sensitive database information.","user_interaction":"not_required","vuln_class":"sql_injection"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"Zabbix","cpe":[{"product":"zabbix","vendor":"zabbix"}],"cvss":{"score":9.1,"severity":"critical","source":"cna","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H","version":"3.1"},"cwes":[{"id":"CWE-20","name":"Improper Input Validation"}],"description":"Zabbix server can perform command execution for configured scripts. After command is executed, audit entry is added to \"Audit Log\". Due to \"clientip\" field is not sanitized, it is possible to injection SQL into \"clientip\" and exploit time based blind SQL injection.","ecosystems":[],"exploits":{"exploitdb":0,"first_seen":"2024-05-20","github_poc":4,"max_poc_stars":137,"metasploit":0,"nuclei":0,"refs":[{"date":"2024-05-20T03:29:09Z","kind":"github_poc","ref":"https://github.com/W01fh4cker/CVE-2024-22120-RCE","stars":137,"title":"Time Based SQL Injection in Zabbix Server Audit Log --\u003e RCE"},{"date":"2024-08-13T14:51:44Z","kind":"github_poc","ref":"https://github.com/isPique/CVE-2024-22120-RCE-with-gopher","stars":3,"title":"This is my exploit for CVE-2024-22120, which involves an SSRF vulnerability inside an XXE with a Gopher payload."},{"date":"2024-08-14T15:55:33Z","kind":"github_poc","ref":"https://github.com/g4nkd/CVE-2024-22120-RCE-with-gopher","stars":3,"title":"This exploit was created to exploit an XXE (XML External Entity). Through it, I read the backend code of the web service and found an endpoint where I could use gopher to make internal requests on Zabbix vulnerable to RCE."},{"date":"2026-05-06T12:41:30Z","kind":"github_poc","ref":"https://github.com/darkbytehunter/CVE-2024-22120-RCE-with-gopher","stars":1,"title":"Proof-of-concept exploit for CVE-2024-22120 that leverages time-based SQL injection and gopher-based SSRF to achieve remote code execution on vulnerable Zabbix servers for educational security research."}],"tier":"weaponised"},"has_fix":true,"headline":"Time Based SQL Injection in Zabbix Server Audit Log","id":"CVE-2024-22120","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":null,"product":"zabbix:zabbix","products":["zabbix:zabbix"],"type":"sql_injection","year":"2024"},"n_packages":0,"n_references":1,"next":{"headline":"Zabbix Agent MSI Installer Allows Non-Admin User to Access Change Option via msiexec.exe","id":"CVE-2024-22121"},"packages":[],"prev":{"headline":"Stored XSS in graph items select form","id":"CVE-2024-22119"},"products":["Zabbix"],"published":"2024-05-17","related":[{"cvss_score":9.1,"headline":"Zabbix Frontend Authentication Bypass","id":"CVE-2022-23131","kev_date_added":"2022-02-22","published":"2022-01-13"},{"cvss_score":10,"headline":"Memory corruption in n/a","id":"CVE-2007-0640","kev_date_added":null,"published":"2007-01-31"},{"cvss_score":9.9,"headline":"SQL injection in user.get API","id":"CVE-2024-42327","kev_date_added":null,"published":"2024-11-27"},{"cvss_score":9.9,"headline":"Remote code execution within ping script","id":"CVE-2024-22116","kev_date_added":null,"published":"2024-08-09"},{"cvss_score":9.8,"headline":"Code injection in n/a","id":"CVE-2013-3738","kev_date_added":null,"published":"2020-02-17"},{"cvss_score":9.8,"headline":"SQL injection in n/a","id":"CVE-2013-5743","kev_date_added":null,"published":"2019-12-11"},{"cvss_score":9.8,"headline":"SQL injection in n/a","id":"CVE-2016-10134","kev_date_added":null,"published":"2017-02-16"}],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"US public information, NVD API terms","name":"NVD"},{"class":"attribution","licence":"CWE Terms of Use","name":"CWE (MITRE)"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"},{"class":"open","licence":"CC0","name":"PoC-in-GitHub"}],"ssvc":{"automatable":"no","exploitation":"poc","technical_impact":"total"},"state":"PUBLISHED","updated":"2024-08-01","vendors":["Zabbix"]},"summary":"Attackers can exploit unsanitized client IP fields in Zabbix audit logs to perform time-based blind SQL injection, potentially reading sensitive database information.","url":"https://insights.sbomify.com/CVE-2024-22120/"}