CVE-2024-36465

Zabbix contains a SQL injection flaw (CWE-89) in include/classes/api/CApiService.php, where the groupBy parameter is passed into SQL queries without proper sanitization. Any low-privilege (regular) Zabbix user with API access can exploit it by sending crafted groupBy values through the API, triggering arbitrary SQL command execution. Successful exploitation gives an attacker high-impact read and write capability against the backend database (CVSS 4.0 rates confidentiality, integrity, and availability impact as High), potentially exposing or modifying monitoring configuration and data. All Zabbix deployments that grant API access to regular users are affected; the provided data does not specify affected version ranges. No public proof-of-concept is known and the flaw is not in CISA KEV, but EPSS assigns a 29.5% probability of exploitation within 30 days (98th percentile), indicating elevated near-term risk.

What to do: Upgrade Zabbix to the patched release published by the vendor for your branch (the fix corrects SQL handling in include/classes/api/CApiService.php). Until patched, restrict API access to trusted users, limit network exposure of the Zabbix API, and audit which accounts hold API permissions. Check logs for API calls containing unexpected or crafted groupBy parameters as a sign of probing or exploitation.