CVE-2026-23921

HIGH

Blind, read-only SQL injection in Zabbix API via sortfield parameter

Title source: CVE List
Search associated code STIX 2.1 vulnerability STIX 2.1 with PoCs

Record summary

CVE-2026-23921 has a selected CVSS score of 8.7 (high); EIP currently links 1 repository PoC.

Description

A low privilege Zabbix user with API access can exploit a blind SQL injection vulnerability in include/classes/api/CApiService.php to execute arbitrary SQL selects via the sortfield parameter. Although query results are not returned directly, an attacker can exfiltrate arbitrary database data through time-based techniques, potentially leading to session identifier disclosure and administrator account compromise.

Description source: CVE List

Exploitation context

Available material

Repository PoCs
1

CISA SSVC decision

ExploitationNone
AutomatableNo
Technical impactTotal

CISA Coordinator · SSVC 2.0.3 · Evaluated Mar 25, 2026 · Source: CVE List

Affected products and versions

1
ProductSourceVersion range

Zabbix

Browse Zabbix / Zabbix

Default status: unknown

CVE List7.0.0 to ≤ 7.0.21affected
7.2.0 to ≤ 7.2.14affected
7.4.0 to ≤ 7.4.5affected

Proofs of concept

1

Repository PoCs

GitHubRichJJ98/analise-vulnerabilidades-zabbix-notebooklmRepository PoCby RichJJ980Writeup1 file

12.4 KiB · linked to 2 vulnerabilities

GitHub
PoC details
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

A Portuguese-language educational writeup analyzing SQL injection vulnerabilities in Zabbix (CVE-2024-42327, CVE-2026-23921). It documents prompt engineering with NotebookLM, describes attack chains from blind SQLi to RCE, and provides hardening recommendations. Contains no exploit or scanner code.

Backdoor review

No backdoor observed in reviewed code

The artifact is a single README.md file containing a Portuguese-language educational write-up about Zabbix SQL injection vulnerabilities. It includes documentation of CVE research, prompt engineering, a study guide, and a glossary. No executable code, scripts, commands, or concealed payloads are present. The content is purely informational and does not exhibit any backdoor, trojan, or deceptive behavior.

ClassificationWriteup
Model confidence95%
AuthenticationRequired
LanguagesPortuguese
Target softwareZabbix
Attack typesSQL InjectionBlind SQL InjectionSession HijackingRemote Code Execution
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The artifact is a README.md containing a thematic notebook on Zabbix SQLi vulnerabilities. It includes technical analysis, attack chain descriptions, and hardening advice, but no executable exploit or scanner code. The analysis_routing classification is NO_POC_CODE_IDENTIFIED, and the content is purely a writeup.

README.md:1-250

Requirements

  • Low-privilege Zabbix user with API accessREADME.md:144

Observed behavior

  • Describes a time-based blind SQLi attack chain via the sortfield parameter to extract session tokens, leading to session hijacking and RCE via Zabbix scripts.README.md:125-172
  • Documents prompt engineering iterations with NotebookLM to analyze Zabbix CVEs.README.md:69-111
  • Provides hardening recommendations including patching, query parameterization, network isolation, and WAF rules.README.md:179-186
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

File Type
Markdown documentationThe only file in the artifact is a README.md containing educational text, badges, and markdown formatting.README.md:1-250
Content Nature
Educational write-up on Zabbix CVEsThe document discusses CVE-2024-42327 and CVE-2026-23921, prompt engineering with NotebookLM, and hardening recommendations. It contains no instructions to execute code or download payloads.README.md:28-35README.md:119-144
Review boundaries

What the analysis did not establish

  • Only one text file (README.md) was provided; no source code, scripts, or configuration files were included.
  • The artifact is a documentation/educational writeup, not executable code.
  • Only the README.md file was provided; no other repository files were included in the evidence packet.
  • Binary files were flagged as metadata-only and not analyzed, though none were identified in the artifact.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

References

2