Two SQL injection flaws in Zabbix show the API account is the real perimeter

A breakdown of CVE-2024-42327 (SQL injection in user.get via selectRole, CVSS 9.9) and CVE-2024-22120 (injection in the audit log clientip field, CVSS 9.1). Fixes shipped in 6.0.32, 6.4.17 and 7.0.1; Qualys counts over 83,000 internet-facing Zabbix servers.

• CVE-2024-42327: SQL injection in user.get, CVSS 9.9, needs only API access, not admin rights
• CVE-2024-22120: injection in the audit log clientip field, CVSS 9.1, no account required
• Patched in 6.0.32, 6.4.17 and 7.0.1; branches 6.0, 6.4 and 7.0 affected
• Qualys found more than 83,000 internet-facing Zabbix servers