Cyber Resilience

CVE-2024-43360

CriticalPublic PoC

Published: 12 August 2024

Published
12 August 2024
Modified
04 September 2024
KEV Added
Patch
CVSS Score v3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.6325 98.4th percentile
Risk Priority 58 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2024-43360 is a critical-severity SQL Injection (CWE-89) vulnerability in Zoneminder Zoneminder. Its CVSS base score is 9.8 (Critical).

Operationally, ranked in the top 1.6% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

Deeper analysis

ZoneMinder, an open source closed-circuit television application, contains a time-based SQL injection vulnerability tracked as CVE-2024-43360. The flaw is classified under CWE-89 and carries a CVSS 3.1 score of 9.8, reflecting network-accessible exploitation with low attack complexity and no required credentials or user interaction. It affects versions prior to the patches released in 1.36.34 and 1.37.61.

An unauthenticated attacker with network access can supply crafted input that triggers time-based SQL injection, allowing extraction or manipulation of database contents and potentially leading to full compromise of confidentiality, integrity, and availability of the ZoneMinder installation.

The project addressed the issue through multiple commits that sanitize inputs and update query handling; the corresponding GitHub Security Advisory GHSA-9cmr-7437-v9fj and the fixed releases provide the authoritative remediation guidance. The associated EPSS score currently stands at 0.6325, matching its observed peak.

EU & UK References

Vulnerability details

ZoneMinder is a free, open source closed-circuit television software application. ZoneMinder is affected by a time-based SQL Injection vulnerability. This vulnerability is fixed in 1.36.34 and 1.37.61.

CWE(s)

Related Threats

No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.

Affected Assets

zoneminder
zoneminder
≤ 1.36.34 · 1.37.00 — 1.37.61

Mitigating Controls

Likely Mitigating Controls AI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

addresses: CWE-89

Penetration testing uses SQL injection payloads against database interfaces, identifying and supporting fixes for SQL injection weaknesses.

addresses: CWE-89

Validates query inputs to prevent SQL syntax or command manipulation.

References