CVE-2023-41884

ZoneMinder is a free, open source Closed-circuit television software application. In WWW/AJAX/watch.php, Line: 51 takes a few parameter in sql query without sanitizing it which makes it vulnerable to sql injection. This vulnerability is fixed in 1.36.34.
SQL Injection
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
7.1 HIGH
NETWORK
LOW
LOW
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N
GitHub_MCNA
7.1 HIGH
NETWORK
LOW
LOW
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N
CISA-ADPADP
---
---
Base Score
CVSS 3.x
EPSS Score
Percentile: 49%
VendorProductVersion
zoneminderzoneminder
𝑥
< 1.36.34
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
zoneminder
bullseye
unimportant
sid
unimportant
bookworm
unimportant
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
zoneminder
oracular
needs-triage
noble
needs-triage
jammy
needs-triage
focal
needs-triage
xenial
needs-triage
Common Weakness Enumeration
References
https://github.com/ZoneMinder/zoneminder/commit/677f6a31551f128554f7b0110a52fd76453a657a
https://github.com/ZoneMinder/zoneminder/commit/a194fe81d34c5eea2ab1dc18dc8df615fca634a6
https://github.com/ZoneMinder/zoneminder/security/advisories/GHSA-2qp3-fwpv-mc96