CVE-2024-42327: SQL injection in user.get API

Record summary

CVE-2024-42327 has a selected CVSS score of 9.9 (critical); EIP currently links 1 catalogued exploit, 11 repository PoCs, and 1 lab environment.

Description

A non-admin user account on the Zabbix frontend with the default User role, or with any other role that gives API access can exploit this vulnerability. An SQLi exists in the CUser class in the addRelatedObjects function, this function is being called from the CUser.get function which is available for every user who has API access.

Description source: CVE List

Exploitation context

Available material

Catalogued exploits: 1
Repository PoCs: 11
Lab environments: 1

CISA SSVC decision

ExploitationNone

AutomatableNo

Technical impactTotal

CISA Coordinator · SSVC 2.0.3 · Evaluated Dec 3, 2024 · Source: CVE List

Affected products and versions

Product	Source	Version range	Status
Zabbix Browse Zabbix / Zabbix Default status: unaffected, unknown	CVE List	6.0.0 to ≤ 6.0.31	affected
		6.4.0 to ≤ 6.4.16	affected
		7.0.0 to ≤ 7.0.1	affected

Proofs of concept

Catalogued exploits

ExploitDBZabbix 7.0.0 - SQL InjectionExploitDB exploitby m4nb4Not analyzed1 file

ExploitDB

PoC details

Repository PoCs

GitHubfellipefelix06/Zabbix-CVE-2024-42327Repository PoCby fellipefelix060Exploit1 file

1.1 KiB

GitHub

PoC details

Analysisdeepseek-v4-pro:cloud · 2026-08-13

Technical assessment

Python script that authenticates to the Zabbix API, creates a script with a reverse shell command, and executes it on a target host. It does not demonstrate or exploit the SQL injection vulnerability described in CVE-2024-42327.

Backdoor review

No backdoor observed in reviewed code

The PoC is a straightforward Python script that uses a hardcoded API token to interact with a local Zabbix instance. It retrieves hosts, creates a script containing a reverse shell command, and executes that script on a target host. All actions are consistent with a disclosed exploit for CVE-2024-42327 (SQL injection leading to privilege escalation). No concealed, deceptive, or unrelated harmful behavior was observed.

ClassificationExploit

Model confidence95%

AuthenticationRequired

LanguagesPython

Target softwareZabbix

Attack typesRemote Code Execution

Evidence & reasoningClassification basis · observed behavior · safety review

Technical evidence

Classification basis and observed behavior

Classification basis

The script performs authenticated API calls to create and execute a reverse shell script on a Zabbix host, which constitutes exploitation of legitimate API functionality for remote code execution. It does not contain any SQL injection payload or code to exploit the CVE-2024-42327 vulnerability.

exploit.py:1-40

Requirements

Valid Zabbix API token with permissions to create and execute scripts.exploit.py:3-5
Network access to the Zabbix frontend API endpoint.exploit.py:4

Observed behavior

Authenticates to the Zabbix API using a hardcoded bearer token.exploit.py:3-5
Retrieves a list of hosts via the host.get API method.exploit.py:13-14
Creates a script named 'pwn3' containing a bash reverse shell command via the script.create API method.exploit.py:26-33
Executes the created script on the first discovered host via the script.execute API method.exploit.py:38-39

Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Hardcoded Credential: Payload withheldA Zabbix API token is hardcoded in the script. This is a placeholder or example credential for the local target; its use is disclosed and not concealed.exploit.py:3
Reverse Shell Command: Payload withheldThe script creates a Zabbix script containing a reverse shell command targeting a placeholder IP. This is the disclosed exploit payload.exploit.py:29

Review boundaries

What the analysis did not establish

The script uses a hardcoded token and does not demonstrate the SQL injection vulnerability described in CVE-2024-42327.
The script's reverse shell payload contains a placeholder IP address (LISTEN_IP) and is not functional without modification.
The script does not include any exploit code for the CUser.addRelatedObjects SQL injection; it only uses legitimate Zabbix API methods.
The review is limited to the supplied text of exploit.py. No network traffic or runtime behavior was observed.

Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

GitHubRichJJ98/analise-vulnerabilidades-zabbix-notebooklmRepository PoCby RichJJ980Writeup1 file

12.4 KiB · linked to 2 vulnerabilities

GitHub

PoC details

Analysisdeepseek-v4-pro:cloud · 2026-08-07

Technical assessment

A Portuguese-language educational writeup analyzing SQL injection vulnerabilities in Zabbix (CVE-2024-42327, CVE-2026-23921). It documents prompt engineering with NotebookLM, describes attack chains from blind SQLi to RCE, and provides hardening recommendations. Contains no exploit or scanner code.

Backdoor review

No backdoor observed in reviewed code

The artifact is a single README.md file containing a Portuguese-language educational write-up about Zabbix SQL injection vulnerabilities. It includes documentation of CVE research, prompt engineering, a study guide, and a glossary. No executable code, scripts, commands, or concealed payloads are present. The content is purely informational and does not exhibit any backdoor, trojan, or deceptive behavior.

ClassificationWriteup

Model confidence95%

AuthenticationRequired

LanguagesPortuguese

Target softwareZabbix

Attack typesSQL InjectionBlind SQL InjectionSession HijackingRemote Code Execution

Evidence & reasoningClassification basis · observed behavior · safety review

Technical evidence

Classification basis and observed behavior

Classification basis

The artifact is a README.md containing a thematic notebook on Zabbix SQLi vulnerabilities. It includes technical analysis, attack chain descriptions, and hardening advice, but no executable exploit or scanner code. The analysis_routing classification is NO_POC_CODE_IDENTIFIED, and the content is purely a writeup.

README.md:1-250

Requirements

Low-privilege Zabbix user with API accessREADME.md:144

Observed behavior

Describes a time-based blind SQLi attack chain via the sortfield parameter to extract session tokens, leading to session hijacking and RCE via Zabbix scripts.README.md:125-172
Documents prompt engineering iterations with NotebookLM to analyze Zabbix CVEs.README.md:69-111
Provides hardening recommendations including patching, query parameterization, network isolation, and WAF rules.README.md:179-186

Safety-review evidence

Behaviors behind the backdoor verdict

Observables

File Type: Payload withheldThe only file in the artifact is a README.md containing educational text, badges, and markdown formatting.README.md:1-250
Content Nature: Payload withheldThe document discusses CVE-2024-42327 and CVE-2026-23921, prompt engineering with NotebookLM, and hardening recommendations. It contains no instructions to execute code or download payloads.README.md:28-35README.md:119-144

Review boundaries

What the analysis did not establish

Only one text file (README.md) was provided; no source code, scripts, or configuration files were included.
The artifact is a documentation/educational writeup, not executable code.
Only the README.md file was provided; no other repository files were included in the evidence packet.
Binary files were flagged as metadata-only and not analyzed, though none were identified in the artifact.

Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

GitHubaramosf/cve-2024-42327Repository PoCby aramosf37Not analyzed3 files

8.8 KiB

GitHub

PoC details

GitHubcompr00t/CVE-2024-42327Repository PoCby compr00t18Not analyzed3 files

8.2 KiB

GitHub

PoC details

GitHubdepers-rus/CVE-2024-42327Repository PoCby depers-rus3Not analyzed2 files

8.4 KiB

GitHub

PoC details

GitHubwatchdog1337/CVE-2024-42327_Zabbix_SQLIRepository PoCby watchdog13373Not analyzed3 files

11.7 KiB

GitHub

PoC details

GitHubitform-fr/Zabbix---CVE-2024-42327Repository PoCby itform-fr0Not analyzed1 file

4.3 KiB

GitHub

PoC details

GitHubigorbf495/CVE-2024-42327Repository PoCby igorbf4950Not analyzed1 file

18.7 KiB

GitHub

PoC details

GitHubBridgerAlderson/Zabbix-CVE-2024-42327-SQL-Injection-RCERepository PoCby BridgerAlderson40Not analyzed2 files

9.0 KiB

GitHub

PoC details

GitHubgodylockz/CVE-2024-42327Repository PoCby godylockz9Not analyzed2 files

10.7 KiB

GitHub

PoC details

GitHub874anthony/CVE-2024-42327_Zabbix_SQLiRepository PoCby 874anthony1Not analyzed2 files

10.9 KiB

GitHub

PoC details

Docker lab environments

GitHub

infrastructure/compose.yaml

compr00t/CVE-2024-42327Created 2024-12-03Vuln labCVE-2024-42327Compose · images

1 Compose manifest · 11 services

View exploit

Analysisdeepseek-v4-pro:cloud · 2026-08-08

Environment assessment

A Docker Compose environment defining a Zabbix monitoring stack with server, proxies, web frontends, agent, Java gateway, SNMP traps, web service, and MySQL database. The README describes a proof-of-concept for CVE-2024-42327, an SQL injection in the Zabbix frontend API.

infrastructure/compose.yaml:1-158README.md:1-44

Lab assessment

Vulnerability lab

The README explicitly states it is a PoC for CVE-2024-42327, provides vulnerable code and a curl request to trigger the SQLi, and the Compose file sets up a Zabbix 6.0.31 environment matching the vulnerable version.

README.md:1-2README.md:9-10infrastructure/compose.yaml:47-48

Lab shapeCompose · images

Services11

Compose manifests1

Dockerfiles0

Evidence & reasoningComponents · CVE assessment · exercise context · review boundaries

Components

Services and files described by the evidence

zabbix-server

Zabbix server (MySQL backend)

Core Zabbix server using MySQL, depends on mysql-server, mounts host /etc/timezone.

infrastructure/compose.yaml:2-10

zabbix-proxy-sqlite3

Zabbix proxy (SQLite3 backend)

Zabbix proxy with SQLite3 storage, mounts host /etc/timezone.

infrastructure/compose.yaml:12-18

zabbix-proxy-mysql

Zabbix proxy (MySQL backend)

Zabbix proxy with MySQL storage, depends on mysql-server, mounts host /etc/timezone.

infrastructure/compose.yaml:20-28

zabbix-web-apache-mysql

Zabbix web frontend (Apache, MySQL)

Zabbix web interface using Apache and MySQL, depends on mysql-server, mounts host /etc/timezone.

infrastructure/compose.yaml:30-38

zabbix-web-nginx-mysql

Zabbix web frontend (Nginx, MySQL, version 6.0.31)

Zabbix web interface using Nginx and MySQL, pinned to image zabbix/zabbix-web-nginx-mysql:6.0.31-alpine, depends on mysql-server, mounts host /etc/timezone. This is the vulnerable component targeted by the PoC.

infrastructure/compose.yaml:40-48README.md:9-10

zabbix-agent

Zabbix agent

Zabbix agent for monitoring, mounts host /etc/timezone.

infrastructure/compose.yaml:50-56

zabbix-java-gateway

Zabbix Java gateway

Gateway for monitoring Java applications via JMX.

infrastructure/compose.yaml:58-63

zabbix-snmptraps

Zabbix SNMP trap receiver

Receives SNMP traps.

infrastructure/compose.yaml:65-70

zabbix-web-service

Zabbix web service

Zabbix web service for scheduled reporting and other functions.

infrastructure/compose.yaml:72-77

mysql-server

MySQL database server

MySQL database for Zabbix server and proxies, defined in external compose_databases.yaml.

infrastructure/compose.yaml:79-81

db-data-mysql

MySQL data volume container

Data volume for MySQL, defined in external compose_databases.yaml.

infrastructure/compose.yaml:83-85

CVE assessment

How the supplied evidence relates each vulnerability

CVE-2024-42327

Supported by supplied evidence

The README explicitly states the PoC is for CVE-2024-42327, provides vulnerable code from version 6.0.31, and the Compose file pins the web frontend to image zabbix/zabbix-web-nginx-mysql:6.0.31-alpine, matching the vulnerable version.

README.md:1-2README.md:9-10infrastructure/compose.yaml:47-48

Exercise context

Requirements and sequence described by the evidence

Prerequisites

A non-admin user account on the Zabbix frontend with the default User role or any role that gives API access.README.md:2
The Zabbix frontend must be running and accessible (e.g., via the zabbix-web-nginx-mysql service).infrastructure/compose.yaml:40-48
The attacker must obtain a valid API authentication token (auth field in the JSON-RPC request).README.md:30

Evidence-described exercise path

Start the Zabbix environment using the provided Compose file.infrastructure/compose.yaml:1-158
Obtain a valid API authentication token for a non-admin user.README.md:2
Send the provided JSON-RPC request to /api_jsonrpc.php with the SQL injection payload in the selectRole parameter.README.md:20-33
Observe the time-based SQL injection effect (SLEEP(5)) to confirm the vulnerability.README.md:28

Safety-review evidence

Behaviors behind the stored safety assessment

No harmful behavior observed

The Compose file defines a standard Zabbix stack with no privileged mode, no host path mounts beyond /etc/timezone (read-only), no port mappings exposing services externally, and no suspicious commands. The README describes a contained SQL injection PoC targeting the lab's own Zabbix frontend. No evidence of host escape, external connectivity, persistence, credential theft, or destructive behavior is present.

infrastructure/compose.yaml:1-158README.md:1-44

Review boundaries

What the analysis did not establish

Missing referenced Compose files compose_databases.yaml and compose_zabbix_components.yaml; their contents are uninspected.
The Compose file uses many environment variables whose values are unknown; the actual runtime configuration may differ.
No Dockerfiles are present; container images are pulled from Docker Hub and their contents are uninspected.
The README provides only a curl request; no exploit script or additional tooling is included in the packet.

Model interpretation

This review is limited to the supplied lab evidence packet. It does not assert that the environment runs, reproduces a vulnerability, or is safe to execute. Contract: eip-docker-lab-analysis-v1.

References

nvd.nist.gov

https://nvd.nist.gov/vuln/detail/CVE-2024-42327

support.zabbix.com

https://support.zabbix.com/browse/ZBX-25623