Description
A non-admin user account on the Zabbix frontend with the default User role, or with any other role that gives API access can exploit this vulnerability. An SQLi exists in the CUser class in the addRelatedObjects function, this function is being called from the CUser.get function which is available for every user who has API access.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Zabbix | Zabbix | — | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | zabbix | 1:7.0.1+dfsg-1 | — |
| Debian 13 | zabbix | 1:7.0.1+dfsg-1 | — |
| Debian 12 | zabbix | No fix yet | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 22.04 LTS | zabbix | No fix yet | — |
| Ubuntu Pro 20.04 LTS | zabbix | No fix yet | — |
Alpine
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.24 | zabbix | 7.0.1-r0 | — |
| Alpine v3.23 | zabbix | 7.0.1-r0 | — |
| Alpine v3.22 | zabbix | 7.0.1-r0 | — |
| Alpine v3.21 | zabbix | 7.0.1-r0 | — |
| Alpine v3.20 | zabbix | 6.4.18-r0 | — |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Exploit-DB 1
- Zabbix 7.0.0 - SQL Injection EDB-52230 · webapps · Apr 16, 2025
GitHub 12 repositories · most starred shown
-
BridgerAlderson/Zabbix-CVE-2024-42327-SQL-Injection-RCE ★ 48 · Jan 1, 2025
Zabbix CVE-2024-42327 PoC
-
aramosf/cve-2024-42327 ★ 38 · Dec 1, 2024
cve-2024-42327 ZBX-25623
-
compr00t/CVE-2024-42327 ★ 18 · Dec 3, 2024
PoC for CVE-2024-42327 / ZBX-25623
-
godylockz/CVE-2024-42327 ★ 9 · Feb 16, 2025
Proof of concept for CVE-2024-42327: Zabbix privilege escalation to RCE
-
watchdog1337/CVE-2024-42327_Zabbix_SQLI ★ 3 · Dec 7, 2024
POC for CVE-2024-42327, an authenticated SQL Injection in Zabbix through the user.get API Method
-
depers-rus/CVE-2024-42327 ★ 3 · Dec 6, 2024
-
RichJJ98/analise-vulnerabilidades-zabbix-notebooklm ★ 1 · Jun 9, 2026
Caderno Temático NotebookLM: análise de vulnerabilidades SQL Injection (CVE-2024-42327, CVE-2026-23921) no Zabbix, com engenharia de prompts, cadeia de ataque até RCE e miniguia de hardening
-
874anthony/CVE-2024-42327_Zabbix_SQLi ★ 1 · Apr 18, 2025
This is for educational porpuses only. Please do not use agains unathorized systems.
-
itform-fr/Zabbix---CVE-2024-42327 ★ 0 · Dec 11, 2024
-
TheCyberGeek/CVE-2024-42327 ★ 0 · Dec 3, 2024
Python PoC for CVE-2024-42327
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Advisories 3
- WID-SEC-2024-3562 Zabbix: Mehrere Schwachstellen BSI CERT-Bund (WID) · Aug 10, 2025
- NCSC-2024-0462 Kwetsbaarheden verholpen in Zabbix NCSC-NL (Netherlands) · Dec 2, 2024
- NCSC-2024-0460 Kwetsbaarheid verholpen in Zabbix NCSC-NL (Netherlands) · Nov 28, 2024