| Package | Affected versions | Patched versions |
|---|---|---|
| zabbix | ≥ 7.0.0, < 7.0.22≥ 7.2.0, < 7.2.15≥ 7.4.0, < 7.4.6 | 7.0.227.2.157.4.6 |
A low privilege Zabbix user with API access can exploit a blind SQL injection vulnerability in include/classes/api/CApiService.php to execute arbitrary SQL selects via the sortfield parameter. Although query results are not returned directly, an attacker can exfiltrate arbitrary database data through time-based techniques, potentially leading to session identifier disclosure and administrator account compromise.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free