{
  "artifact_sha256": {
    "repro/proof/fixed/attempt_metadata.json": "7ba66603b7e3332c657f8807b616e5fc0888975647c37257177617d67af9f56d",
    "repro/proof/fixed/container_identity.json": "4d53f636b9466f763e26224055b5f82b51b7d5cbb5d77ca60c94c390a7b5ccf0",
    "repro/proof/fixed/false_probe_request.json": "f55512006f522d394fe663cf5ec0b015d58cda4caca0948fb434fcb78e09346d",
    "repro/proof/fixed/loaded_component.txt": "c8b7a99a0f59787315c27969c7f161da5e7b1bf9621165214d32158689be0191",
    "repro/proof/fixed/low_user_identity.json": "904fc0a0797d0a454a463baec909d7f168e0da6cc52a50f7618969b2dc8964a5",
    "repro/proof/fixed/product_version.txt": "70e56a4c95d1f10350820dfcea7a58def1a26a7387b2e747423ba40bf88575dd",
    "repro/proof/fixed/server_final.log": "1ab07bb9fb41fc6a8a2c99b1c3a0488196dfb779465a6f4d26f0d1024cd19c87",
    "repro/proof/fixed/timing_results.json": "6df391a1630606c7029c8b9d788333c70908497484225ef0b28cd16df67f63d0",
    "repro/proof/fixed/true_probe_request.json": "1fc9e1093e56f40b00291a75de4af4d83ea2c5e51d9ffe341533b8543e638c36",
    "repro/proof/fixed/web_final.log": "d596b76acb3e7464a21101e264e5d16b1dfee1b2989ef186584945f7a2d03034",
    "repro/proof/verdict.json": "5a571f1162307af54b25901093fe54711ac4541ccbb6de29c399fe594214e642",
    "repro/proof/vulnerable/attempt_metadata.json": "2e785d5036afc3706e54cbc7a6270c23faafb9a6096d3cc7281cf5a123600efa",
    "repro/proof/vulnerable/baseline_response.json": "e2a6b77aa477bd0ac2fa5916ca4aa6f0e5e3fd6e34589e06185e7b64fa46be18",
    "repro/proof/vulnerable/container_identity.json": "cd4f31fa50d8ed0be3f147e04f38e06b8450a3b3f3935ab193ab03a1485ad299",
    "repro/proof/vulnerable/false_probe_request.json": "f55512006f522d394fe663cf5ec0b015d58cda4caca0948fb434fcb78e09346d",
    "repro/proof/vulnerable/loaded_component.txt": "5e135bf89ce7fb2ae4fe05092b6be9c4ba13ae18450060d25ef4908d8b46c6ee",
    "repro/proof/vulnerable/low_user_identity.json": "c0d7b2f96c494fcbe8bf8e35b95f69d01efed4391ecdb1f82082bcefd58b7ada",
    "repro/proof/vulnerable/product_version.txt": "b23d8d9814815dcfb987e70430e004018460e47854543d604c4419a3fa9fa7b9",
    "repro/proof/vulnerable/server_final.log": "48cab59924464185da64e1f7bdb81bd2f35f16bdc9455b608b7cea470b9b67b1",
    "repro/proof/vulnerable/timing_results.json": "9bc044d8cee9f883e46b559988b321b2a1464c4fc9cc1810e4c6fda10262b6f5",
    "repro/proof/vulnerable/true_probe_request.json": "1fc9e1093e56f40b00291a75de4af4d83ea2c5e51d9ffe341533b8543e638c36",
    "repro/proof/vulnerable/web_final.log": "fc93a3768bbde22f81c4d05b91739346be35fafa92ecc9a727cf64f1e84a91e6"
  },
  "entrypoint_detail": "POST /api_jsonrpc.php, authenticated host.get with attacker-controlled groupBy and sortfield",
  "entrypoint_kind": "endpoint",
  "healthcheck_passed": true,
  "notes": "Image-backed target. Official Zabbix 7.0.21 product image; corresponding source tag 6542e21fe6adc8ab7bf903c2a9d1df80e80366cd. Real authenticated JSON-RPC endpoint proof: low-privilege User role; repeatable timing oracle; clean 7.0.22 fixed negative control.",
  "proof_artifacts": [
    "repro/proof/verdict.json",
    "repro/proof/vulnerable/attempt_metadata.json",
    "repro/proof/vulnerable/low_user_identity.json",
    "repro/proof/vulnerable/false_probe_request.json",
    "repro/proof/vulnerable/true_probe_request.json",
    "repro/proof/vulnerable/baseline_response.json",
    "repro/proof/vulnerable/timing_results.json",
    "repro/proof/vulnerable/product_version.txt",
    "repro/proof/vulnerable/loaded_component.txt",
    "repro/proof/vulnerable/container_identity.json",
    "repro/proof/vulnerable/web_final.log",
    "repro/proof/vulnerable/server_final.log",
    "repro/proof/fixed/attempt_metadata.json",
    "repro/proof/fixed/low_user_identity.json",
    "repro/proof/fixed/timing_results.json",
    "repro/proof/fixed/product_version.txt",
    "repro/proof/fixed/loaded_component.txt",
    "repro/proof/fixed/container_identity.json",
    "repro/proof/fixed/false_probe_request.json",
    "repro/proof/fixed/true_probe_request.json",
    "repro/proof/fixed/web_final.log",
    "repro/proof/fixed/server_final.log"
  ],
  "runtime_stack": [
    "mysql:8.0.40",
    "zabbix-server-mysql:7.0.21 and 7.0.22",
    "zabbix-web-apache-mysql:7.0.21 and 7.0.22"
  ],
  "service_started": true,
  "target_identity": {
    "architecture": "x86_64",
    "image": "zabbix/zabbix-web-apache-mysql@sha256:0282eba8bac999284672e3abaefbdd28b16026bae6a1673a7f560f35eb2c712d",
    "platform": "linux",
    "runtime_digest": "0282eba8bac999284672e3abaefbdd28b16026bae6a1673a7f560f35eb2c712d",
    "target_digest": "0282eba8bac999284672e3abaefbdd28b16026bae6a1673a7f560f35eb2c712d"
  },
  "target_path_reached": true
}