{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/zabbix--7.2.15/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:zabbix:zabbix:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":8.8,"id":"CVE-2026-23921"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Zabbix (\u003c 7.0.22)","Zabbix (\u003c 7.2.15)","Zabbix (\u003c 7.4.6)"],"_cs_severities":["high"],"_cs_tags":["cve-2026-23921","sql-injection","zabbix"],"_cs_type":"advisory","_cs_vendors":["Zabbix"],"content_html":"\u003cp\u003eCVE-2026-23921 is a time-based blind SQL injection vulnerability in the Zabbix API. The flaw exists in \u003ccode\u003eCApiService::applyQuerySortOptions()\u003c/code\u003e where a failure to properly validate the \u003ccode\u003esortfield\u003c/code\u003e parameter when combined with a user-supplied \u003ccode\u003egroupBy\u003c/code\u003e array allows for SQL injection. Attackers can provide a malicious payload that reaches the \u003ccode\u003eORDER BY\u003c/code\u003e clause of SQL queries without sanitization. The vulnerability affects Zabbix versions prior to 7.0.22, 7.2.15, and 7.4.6. Public exploit code is available.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker authenticates to the Zabbix API using a valid user account.\u003c/li\u003e\n\u003cli\u003eAttacker invokes an API method such as \u003ccode\u003ehost.get\u003c/code\u003e, \u003ccode\u003etrigger.get\u003c/code\u003e, or \u003ccode\u003eitem.get\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eAttacker injects a payload into the \u003ccode\u003egroupBy\u003c/code\u003e parameter and the \u003ccode\u003esortfield\u003c/code\u003e parameter.\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003ezbx_array_merge()\u003c/code\u003e function merges the attacker-controlled \u003ccode\u003egroupBy\u003c/code\u003e into the options array.\u003c/li\u003e\n\u003cli\u003e\u003ccode\u003eCApiService::applyQuerySortOptions()\u003c/code\u003e validates the \u003ccode\u003esortfield\u003c/code\u003e using the attacker-controlled \u003ccode\u003egroupBy\u003c/code\u003e input, effectively bypassing the whitelist.\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003ecreateSelectQueryFromParts()\u003c/code\u003e function generates the final SQL query containing the unsanitized \u003ccode\u003eORDER BY\u003c/code\u003e clause.\u003c/li\u003e\n\u003cli\u003eThe database executes the injected SQL, allowing for time-based data exfiltration via \u003ccode\u003epg_sleep()\u003c/code\u003e or equivalent functions.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows for blind, time-based data exfiltration from the underlying database (PostgreSQL or MySQL). An attacker must have valid API credentials to reach the vulnerable code path.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade Zabbix immediately to version 7.0.22, 7.2.15, 7.4.6, or higher to receive the patch that replaces \u003ccode\u003earray_merge\u003c/code\u003e with \u003ccode\u003earray_intersect\u003c/code\u003e for input validation.\u003c/li\u003e\n\u003cli\u003eAudit Zabbix API access logs for anomalous \u003ccode\u003esortfield\u003c/code\u003e or \u003ccode\u003egroupBy\u003c/code\u003e usage patterns.\u003c/li\u003e\n\u003cli\u003eRestrict access to the Zabbix API to authorized IP addresses or internal networks.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-28T16:04:52Z","date_published":"2026-10-28T16:04:52Z","id":"https://feed.craftedsignal.io/briefs/2026-10-zabbix-sql-injection/","summary":"A time-based blind SQL injection vulnerability in Zabbix API (CVE-2026-23921) allows authenticated attackers to exfiltrate database data via malicious input to the sortfield and groupBy parameters.","title":"Zabbix: SQL injection in API sortfield parameter (CVE-2026-23921)","url":"https://feed.craftedsignal.io/briefs/2026-10-zabbix-sql-injection/"}],"language":"en","title":"CraftedSignal Threat Feed - Zabbix (\u003c 7.2.15)","version":"https://jsonfeed.org/version/1.1"}