ZoneMinder contains SQL Injection via report_event_audit
CVE-2023-26037

8.9HIGH

Key Information:

Vendor

Zoneminder

Status
Zoneminder
Vendor
CVE Published:
25 February 2023

What is CVE-2023-26037?

ZoneMinder, an open-source CCTV software for Linux, is susceptible to SQL injection due to insufficient validation of the minTime and maxTime parameters in user requests. This vulnerability allows potential attackers to execute arbitrary SQL commands, compromising the integrity of the database and sensitive data. Users are urged to upgrade to ZoneMinder versions 1.36.33, 1.37.33 or later to mitigate this risk. For detailed remediation steps, visit the official advisory.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch

Affected Version(s)

zoneminder < 1.36.33 < 1.36.33

zoneminder >= 1.37.0, < 1.37.33 < 1.37.0, 1.37.33

References

https://github.com/ZoneMinder/zoneminder/security/advisor...
x_refsource_CONFIRM

CVSS V3.1

Score:
8.9
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.