CVE-2024-36465: 
Zabbix Server vulnerability analysis and mitigation

A SQL injection vulnerability was identified in Zabbix's API service, specifically in the include/classes/api/CApiService.php file. The vulnerability, tracked as CVE-2024-36465, allows a low-privileged Zabbix user with API access to execute arbitrary SQL commands through the groupBy parameter. This vulnerability was disclosed on April 1, 2025, affecting multiple versions of Zabbix (Debian Tracker, NVD).

The vulnerability is classified as SQL Injection (CWE-89) and received a CVSS 4.0 base score of 8.6 (HIGH) with the vector string CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N. The issue specifically exists in the API service's handling of the groupBy parameter, which fails to properly sanitize user input, allowing for SQL injection attacks (NVD).

The vulnerability allows attackers with low-privilege user accounts to execute arbitrary SQL commands through the API, potentially leading to unauthorized data access, data manipulation, or broader system compromise. The high CVSS score indicates significant potential impact on the confidentiality, integrity, and availability of the affected system (NVD).

The vulnerability requires a low-privileged user account with API access to exploit. The attack complexity is considered low, requiring no user interaction, making it relatively straightforward to exploit for attackers who meet the prerequisite conditions (NVD).

Fixed versions have been released in Zabbix 7.0.8rc2, 7.2.2rc1, and 7.4.0alpha1. Users are advised to upgrade to these or later versions to address the vulnerability. The fix has been implemented in the Debian distribution version 1:7.0.10+dfsg-2 (Debian Tracker, Zabbix Issue).