CVE-2023-41884

EUVD-2023-46370
ZoneMinder is a free, open source Closed-circuit television software application. In WWW/AJAX/watch.php, Line: 51 takes a few parameter in sql query without sanitizing it which makes it vulnerable to sql injection. This vulnerability is fixed in 1.36.34.
SQL Injection
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
7.1 HIGH
NETWORK
LOW
LOW
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N
Base Score
CVSS 3.x
EPSS Score
Percentile: Unknown
Affected Products (NVD)
VendorProductVersion
zoneminderzoneminder
𝑥
< 1.36.34
𝑥
= Vulnerable software versions
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources.
VendorProductVersionSource
zoneminderzoneminder
𝑥
< 1.36.34
ADP
Debian logo
Debian Releases
Debian Product
Codename
zoneminder
bookworm
unimportant
bullseye
unimportant
sid
unimportant
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
zoneminder
focal
needs-triage
jammy
needs-triage
noble
needs-triage
oracular
needs-triage
xenial
needs-triage
Common Weakness Enumeration
References
https://github.com/ZoneMinder/zoneminder/commit/677f6a31551f128554f7b0110a52fd76453a657a
https://github.com/ZoneMinder/zoneminder/commit/a194fe81d34c5eea2ab1dc18dc8df615fca634a6
https://github.com/ZoneMinder/zoneminder/security/advisories/GHSA-2qp3-fwpv-mc96