{"id":"CVE-2024-22120","published":"2024-05-17T09:53:52Z","modified":"2024-08-01T22:35:34Z","title":"Time Based SQL Injection in Zabbix Server Audit Log","vendor":"Zabbix","product":"Zabbix","tier":"core","eol":null,"affectedVersions":[{"vendor":"Zabbix","product":"Zabbix","versions":[">= 6.0.0, <= 6.0.27",">= 6.4.0, <= 6.4.12",">= 7.0.0alpha1, <= 7.0.0beta1"]}],"description":{"text":"Zabbix server can perform command execution for configured scripts. After command is executed, audit entry is added to \"Audit Log\". Due to \"clientip\" field is not sanitized, it is possible to injection SQL into \"clientip\" and exploit time based blind SQL injection.","provenance":"source","from":"CVE.org"},"summary":{"text":"Zabbix Server's audit log component fails to sanitise the \"clientip\" field, which is written into the Audit Log when a configured script is executed. An attacker who can reach the server and hold privileges sufficient to trigger script execution can inject SQL through that field to carry out time-based blind SQL injection, with no user interaction required.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-29T07:12:03Z"},"cvss":{"score":9.1,"severity":"CRITICAL","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.76618,"percentile":0.99542,"date":"2026-10-29","provenance":"source"},"kev":null,"vulncheckKev":{"dateAdded":"2025-03-19","exploitedFirstSeen":"2025-03-19","ransomware":false,"evidence":[{"url":"https://cyble.com/blog/cyble-sensors-detect-exploit-attempts-on-ivanti-avtech-ip-cameras/","date":"2025-03-19"}],"evidenceTotal":1,"provenance":"source"},"exploited":true,"otx":{"pulseCount":1,"pulses":[{"name":"Midwest Malware","url":"https://otx.alienvault.com/pulse/6a8e6c8dc6d3df83aac08378","created":"2026-08-26"}],"provenance":"machine"},"cwes":[{"id":"CWE-20","name":"Improper Input Validation"}],"references":[{"url":"https://support.zabbix.com/browse/ZBX-24505","tags":[]}],"techniques":[],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2024-19716","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2024-19716","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[],"exploitSources":{"pocGithub":{"count":4,"skipped":0,"earliest":"2024-05-20","earliestUrl":"https://github.com/W01fh4cker/CVE-2024-22120-RCE","repos":[{"name":"W01fh4cker/CVE-2024-22120-RCE","url":"https://github.com/W01fh4cker/CVE-2024-22120-RCE","stars":137,"created":"2024-05-20"},{"name":"isPique/CVE-2024-22120-RCE-with-gopher","url":"https://github.com/isPique/CVE-2024-22120-RCE-with-gopher","stars":3,"created":"2024-08-13"},{"name":"g4nkd/CVE-2024-22120-RCE-with-gopher","url":"https://github.com/g4nkd/CVE-2024-22120-RCE-with-gopher","stars":3,"created":"2024-08-14"},{"name":"darkbytehunter/CVE-2024-22120-RCE-with-gopher","url":"https://github.com/darkbytehunter/CVE-2024-22120-RCE-with-gopher","stars":1,"created":"2026-05-06"}]},"first":{"date":"2024-05-20","source":"PoC-in-GitHub","url":"https://github.com/W01fh4cker/CVE-2024-22120-RCE"},"provenance":"source"},"exploitRefs":[],"flow":[],"timeline":[{"date":"2024-05-17","kind":"published","label":"Published (CVE.org)","url":"https://www.cve.org/CVERecord?id=CVE-2024-22120","provenance":"source"},{"date":"2024-05-20","kind":"exploit-public","label":"First public exploit: PoC-in-GitHub","url":"https://github.com/W01fh4cker/CVE-2024-22120-RCE","provenance":"source"},{"date":"2025-03-19","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://cyble.com/blog/cyble-sensors-detect-exploit-attempts-on-ivanti-avtech-ip-cameras/","provenance":"source"}],"speed":{"daysToPublicExploit":3,"firstExploitFrom":"PoC-in-GitHub","daysToKev":null},"priority":{"score":67.0,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 590 days ago"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.91,"detail":"percentile 0.9954"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"4 PoC-in-GitHub repos"},{"name":"Mentioned in OTX pulses","points":0.68,"detail":"1 pulse"},{"name":"CVSS severity","points":6.37,"detail":"base score 9.1"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}