HTTP: Zabbix addRelatedObjects SQL Injection
This signature detects attempts to exploit a known vulnerability against Zabbix Server. A successful attack can lead to command injection and arbitrary code execution.
Extended Description
A non-admin user account on the Zabbix frontend with the default User role, or with any other role that gives API access can exploit this vulnerability. An SQLi exists in the CUser class in the addRelatedObjects function, this function is being called from the CUser.get function which is available for every user who has API access.
Short Name
HTTP:SQL:INJ:ZABBIX-SERVER-ADD
Severity
Major
Recommended
True
Recommended Action
Drop
Category
HTTP
Keywords
CVE-2024-36465 CVE-2024-42327 CVE-2025-27240 Injection SQL Zabbix addRelatedObjects
Release Date
12/20/2024
Supported Platforms
srx-branch-12.3
srx-19.3
srx-branch-19.3
vsrx3bsd-19.2
srx-branch-19.4
vsrx-19.4
mx-12.3
mx-19.4
vmx-19.4
mx-19.3
vsrx3bsd-19.4
srx-19.4
vsrx-12.3
vmx-19.3
vsrx-19.2
srx-12.3
Sigpack Version
3861
False Positive
Unknown