Zabbix 需授权 外部资源引用不当漏洞

Description

PoC

None yet. Search at https://trap.biu.life/?ref=rss

References

• https://www.zabbix.com/documentation/7.0/zh/manual/installation/known_issues
• https://developer.volcengine.com/articles/7381514893209370633
• https://cloud.tencent.com/developer/article/2148973
• https://cdn.isc.360.com/isc-cxo/2024_Vulnerability_Report.pdf
• https://www.geekby.site/2022/03/zabbix%E6%BC%8F%E6%B4%9E%E6%B7%B1%E5%85%A5%E5%88%A9%E7%94%A8/
• https://www.sentinelone.com/vulnerability-database/cve-2026-23919/
• https://www.tenable.com/plugins/nessus/301859
• https://nvd.nist.gov/vuln/detail/CVE-2025-27232
• https://support.zabbix.com/browse/ZBX-27567
• https://www.oscs1024.com/hd/MPS-5dm7-vk2h

Related Vulnerabilities

• Zabbix /api_jsonrpc.php SQL 注入漏洞（CVE-2024-36465）
• PoCCVE-2024-22120: Zabbix Server - Time-Based Blind SQL injection
• PoCCVE-2016-10134: Zabbix - SQL Injection
• PoCCVE-2019-17382: Zabbix <=4.4 - Authentication Bypass
• PoCCVE-2022-23131: Zabbix - SAML SSO Authentication Bypass
• PoCCVE-2022-23134: Zabbix Setup Configuration Authentication Bypass
• PoCCVE-2022-26148: Grafana & Zabbix Integration - Credentials Disclosure
• PoCCVE-2016-10134: Zabbix SQL Injection Vulnerability
• PoCzabbix-default-password: Zabbix Default Password