Skip to content
Threat Feed
Subscribe
high advisory

ZoneMinder: Authenticated SQL Injection in event management (CVE-2024-51482)

An authenticated time-based blind SQL injection vulnerability in ZoneMinder versions up to 1.37.64 allows attackers to exfiltrate sensitive database information via the removetag action.

CVE search metadata

CVE search record: CVE-2024-51482. Severity: critical. CVSS: 9.9. EPSS: 36.61%. KEV: no. Product: ZoneMinder (<= 1.37.64). Brief: ZoneMinder: Authenticated SQL Injection in event management (CVE-2024-51482). Brief link: https://feed.craftedsignal.io/briefs/2026-10-zoneminder-sqli/

Triage facts

Revision 1
Applicability
ZoneMinder (<= 1.37.64)
Evidence
Unknown
Severity
High
Action
Elevated
Sources
3 public sources
Freshness
Revision 1Oct 24, 04:05 UTC
Detection
1 rule
Vulnerabilities
1 CVE
Source quality
B2Likely

CVE-2024-51482 is a time-based blind SQL injection vulnerability affecting ZoneMinder versions through 1.37.64. The flaw exists within the event management functionality of the application. An authenticated attacker can trigger this vulnerability by sending specially crafted requests to the /zm/index.php endpoint, specifically targeting the removetag action and the tid parameter. The vulnerability enables attackers to extract data from the backend database using conditional SLEEP payloads.

Impact

Successful exploitation allows authenticated attackers to perform database enumeration and dump sensitive information, including user credentials stored in the zm.Users table. The CVSS score for this vulnerability is 9.9.

Recommendation

  • Upgrade ZoneMinder to version 1.37.65 or later immediately to patch the vulnerability.
  • Audit access logs for authenticated users performing frequent or anomalous POST requests to /zm/index.php with the action=removetag parameter.
  • Restrict access to the ZoneMinder interface to trusted networks only.

Immediate actions

Patch ZoneMinder to 1.37.65

IT Operations 48h

Threat Hunt

Identify authenticated sessions with unusual sleep-like timing patterns or repeated POST requests to index.php

T1190 high medium confidence hunt now

Data: Web server response time logs

Enrichment needed

  • Internal instance inventory (IT Operations) Identify exposure of ZoneMinder instances

Mitigations

Upgrade to version 1.37.65

immediate IT Operations

CVE-2024-51482

Gaps

  • Lack of dedicated WAF signature for this specific injection path

Detection coverage 1

Detects CVE-2024-51482 Exploitation - SQL Injection in removetag

high

Detects exploitation attempts against CVE-2024-51482 by identifying HTTP requests to the removetag action containing potential SQL injection patterns within the tid parameter.

sigma tactics: initial_access techniques: T1190 sources: webserver

Detection queries are available on the platform. Get full rules →