SQL injection in ZoneMinder - #VU158947
Published: November 3, 2026
Vulnerability identifier: #VU158947
CSH Severity: Low
CVSS v4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:L/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-89
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to disclose sensitive database information and delay database queries.
The vulnerability exists due to improper neutralization of SQL expressions in the event filter sort_field handling when loading a report linked to a saved filter. A remote user can save a crafted sort_field value, such as SLEEP(5), that passes through strip_tags() and is later concatenated directly into an SQL ORDER BY clause to extract sensitive database information through blind SQL injection or delay query execution.
Affected software
ZoneMinder
Remediation
Install security update from vendor's website.
ZoneMinder - update to 1.39.11