CVE-2013-5743: Zabbix SQL injection in multiple components

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: medium.

critical priorityCVSS 9.8 with network reachability, no authentication, and high confidentiality, integrity, and availability impact, combined with a very high EPSS score, makes this a top remediation priority despite the lack of KEV listing.

What it is

Zabbix versions 1.8.x before 1.8.18rc1, 2.0.x before 2.0.9rc1, and 2.1.x before 2.1.7 contain multiple SQL injection vulnerabilities. The record does not name the specific vulnerable components or parameters, only that multiple injection points exist. Because Zabbix is a monitoring platform often holding credentials and infrastructure data, successful injection can expose or alter the backend database.

Impact

An unauthenticated remote attacker can read, modify, or delete data in the Zabbix backend database, potentially leading to full compromise of the monitoring platform and any credentials or host data it stores.

Attack surface

Reachable over the network via the Zabbix web interface or API endpoints that build SQL queries from user input. The CVSS vector indicates no authentication and no user interaction are required.

Exploitation

Not listed in CISA KEV and no ransomware usage is documented. EPSS is very high at roughly 0.80 (99.6th percentile), suggesting elevated likelihood of exploitation activity, though the record provides no public exploit reference.

What to do

• Upgrade to Zabbix 1.8.18rc1, 2.0.9rc1, or 2.1.7 and later as applicable to your branch, per the vendor advisory ZBX-7091.
• If immediate upgrade is not possible, restrict network access to the Zabbix web interface and API to trusted management networks only.
• Review database accounts used by Zabbix and apply least privilege so injection cannot reach unrelated schemas.
• Audit Zabbix frontend and API logs for anomalous SQL-like input and unexpected database errors.
• Rotate credentials stored or monitored by Zabbix if compromise is suspected.

Detection

• Search web server and Zabbix frontend logs for SQL metacharacters and injection patterns in request parameters.
• Monitor database logs for malformed or error-generating queries originating from the Zabbix application account.
• Alert on unexpected outbound connections or data volume changes from the Zabbix server or database host.
• Baseline normal Zabbix API and frontend request patterns and flag deviations, especially unauthenticated requests to query-heavy endpoints.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.