CVE-2024-51482

Deeper analysis

ZoneMinder is a free open-source CCTV application that contains a boolean-based SQL injection vulnerability in the web/ajax/event.php component. The flaw affects versions 1.37.* through 1.37.64 and is tracked as CWE-89; it received a CVSS 3.1 score of 9.9 reflecting network-accessible, low-complexity exploitation by an authenticated user that can fully compromise confidentiality, integrity, and availability with changed scope.

An authenticated attacker with low privileges can supply crafted input to the affected endpoint and extract or manipulate database contents, potentially leading to full system compromise within the application’s security context. The vulnerability is exploitable remotely without user interaction once an account is obtained.

The project addressed the issue in release 1.37.65. The corresponding patch is documented in GitHub commit 9e7d31841ed9678a7dd06869037686fc9925e59f and in the ZoneMinder security advisory GHSA-qm8h-3xvf-m7j3, which recommend upgrading to the fixed version.

EPSS for the CVE reached a peak of 0.6116 after disclosure before settling at the current value of 0.5086, indicating measurable post-publication exploitation interest.