Description
Zabbix server can perform command execution for configured scripts. After command is executed, audit entry is added to "Audit Log". Due to "clientip" field is not sanitized, it is possible to injection SQL into "clientip" and exploit time based blind SQL injection.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Zabbix | Zabbix | — | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | zabbix | 1:6.0.29+dfsg-1 | — |
| Debian 13 | zabbix | 1:6.0.29+dfsg-1 | — |
| Debian 12 | zabbix | No fix yet | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | zabbix | No fix yet | — |
| Ubuntu 26.04 LTS | zabbix | No fix yet | — |
| Ubuntu 25.10 | zabbix | No fix yet | — |
Show 5 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 22.04 LTS | zabbix | No fix yet | — |
| Ubuntu Pro 20.04 LTS | zabbix | No fix yet | — |
| Ubuntu Pro 18.04 LTS | zabbix | No fix yet | — |
| Ubuntu Pro 16.04 LTS | zabbix | No fix yet | — |
| Ubuntu Pro 14.04 LTS | zabbix | No fix yet | — |
Alpine
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.19 | zabbix | 6.4.14-r0 | — |
| Alpine v3.18 | zabbix | 6.4.15-r0 | — |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
GitHub 4 repositories
-
W01fh4cker/CVE-2024-22120-RCE ★ 138 · May 20, 2024
Time Based SQL Injection in Zabbix Server Audit Log --> RCE
-
g4nkd/CVE-2024-22120-RCE-with-gopher ★ 3 · Aug 14, 2024
This exploit was created to exploit an XXE (XML External Entity). Through it, I read the backend code of the web service and found an endpoint where I could use gopher to make internal requests on Za…
-
isPique/CVE-2024-22120-RCE-with-gopher ★ 3 · Aug 13, 2024
This is my exploit for CVE-2024-22120, which involves an SSRF vulnerability inside an XXE with a Gopher payload.
-
darkbytehunter/CVE-2024-22120-RCE-with-gopher ★ 1 · May 6, 2026
Proof-of-concept exploit for CVE-2024-22120 that leverages time-based SQL injection and gopher-based SSRF to achieve remote code execution on vulnerable Zabbix servers for educational security resear…
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Advisories 1
- WID-SEC-2024-1192 Zabbix: Schwachstelle ermöglicht Codeausführung BSI CERT-Bund (WID) · May 20, 2024