Monitoring systems are the most trusted readers in an estate. Zabbix agents report from every host, the server stores what they report, and the front end renders it to whoever holds a session. Two SQL injection issues disclosed in 2024 show what that trust is worth when the query layer stops being careful.
The first flaw
CVE-2024-42327 covers the user.get API method. When the caller includes selectRole in the request, the server builds a query through a code path where the role identifier is not parameterised as it should be. A user with API access does not need administrative rights to reach the vulnerable method, which is what pushed the score to 9.9. Affected ranges are 6.0.0 through 6.0.31, 6.4.0 through 6.4.16, and 7.0.0 before the fix, with patched builds at 6.0.32, 6.4.17 and 7.0.1.
The consequence of a successful injection here reaches the database account Zabbix uses, which holds the entire monitoring dataset plus the user and session tables. From there the usual escalation applies: read a session identifier, adopt a role, or write an administrative account into the table and log in with it.
The second flaw
CVE-2024-22120 sits in the audit log. The clientip field recorded during login is written through a query that does not treat it as data. A caller who controls the apparent source address can shape that value and reach the database from a position that, on several deployments, requires only the ability to reach the front end. Scored 9.1, affecting 6.0.0 through 6.0.27, 6.4.0 through 6.4.12 and 7.0.0 alpha builds, fixed in 6.0.28, 6.4.13 and 7.0.0beta2. The severity comes from not needing an account: the login attempt that carries the payload can fail and the injection still runs.
A related issue in the same period, CVE-2024-22116, described command injection through a ping script in 6.4.9 through 6.4.15. It matters less as a separate bug than as a demonstration that parameters rendered into scripts are a recurring pattern across this product family.
What an attacker inherits
Zabbix knows the shape of the network. It holds host inventories, agent addresses, SNMP community strings, trap handlers, alerting credentials for mail and chat relays, script definitions that execute on monitored hosts, and the session table. An administrative position is therefore not just access to graphs. It is a distribution channel to every managed node, because the same script mechanism administrators use for maintenance is available to whoever holds the role.
That last property changes the containment logic. Restoring from backup and rotating passwords is insufficient if an intruder added a script, a user, or an item that executes on a schedule. The monitoring plane has to be compared against a known-good configuration rather than merely restored to one.
Why the exposure persists
A Qualys study of internet-facing Zabbix servers put the population above 83,000. An application fingerprint query run for this article on 2026-10-23 returned 4,903 results for Zabbix and a title-based query returned 120,274, which is a reminder of how much a fingerprint and a text match disagree when a product name appears in page titles across documentation, mirrors and tutorials. Neither number counts vulnerable hosts. Both describe a population large enough that scanning is worthwhile, and both include appliances, vendor consoles and lab instances where nobody tracks the release.
The more useful observation is architectural. Zabbix deployments get published because monitoring has to be reachable from the systems it watches, and that reachability argument quietly extends to the internet in more estates than anyone intended. An exposure that begins as a convenient status page becomes an authenticated API with a nine-point-nine SQL injection behind it.
What to check and change
- 1.
Enumerate API-enabled accounts, including non-administrative ones. The first CVE does not require an administrator, and every API account is an injection origin.
- 2.
Review the audit log for clientip values containing SQL syntax or encoded characters. The second CVE leaves evidence in the data it writes.
- 3.
Compare users, roles, scripts and scheduled items against a baseline. A patched installation with an extra script is not remediated.
- 4.
Place the front end behind single sign-on and restrict management access to a known address set, since monitoring does not need to be public to work.
- 5.
Rotate every credential the server holds: agent keys, SNMP community strings, alerting webhooks and database passwords.
References
NVD record for CVE-2024-42327, SQL injection in Zabbix user.get with selectRole.
Zabbix security advisory covering CVE-2024-42327 and the fixed 6.0.32, 6.4.17 and 7.0.1 releases.
NVD record for CVE-2024-22120, SQL injection in the Zabbix audit log clientip field.
NVD record for CVE-2024-22116, command injection through a Zabbix ping script.
Qualys research on internet-facing Zabbix servers and exposure volume.
ZoomEye measurements performed 2026-10-23 for the Zabbix application fingerprint and title match.