EIP-2026-114561

The exploit demonstrates an unauthenticated SQL injection vulnerability in Zabbix <= 1.8.1 via the API's user.authenticate method. It uses time-based blind SQLi to extract password hashes and check for MySQL root account usage.