SQL injection in ZoneMinder - CVE-2024-43360
Published: August 12, 2024 / Updated: November 3, 2026
Vulnerability identifier: #VU158930
CSH Severity: High
CVSS v4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2024-43360
CWE-ID: CWE-89
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to disclose or modify sensitive database information and potentially cause a denial of service.
The vulnerability exists due to improper neutralization of SQL input in ZoneMinder when processing user-supplied input used in database queries. A remote attacker can submit crafted input that changes SQL query logic and triggers conditional delays to infer database information, potentially modify database contents, or disrupt database availability.
Affected software
ZoneMinder
How to mitigate CVE-2024-43360
Install security update from vendor's website.
ZoneMinder - update to 1.36.33