ZoneMinder (<= 1.37.64) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/zoneminder--1.37.64/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioSat, 24 Oct 2026 04:05:34 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgZoneMinder: Authenticated SQL Injection in event management (CVE-2024-51482)https://feed.craftedsignal.io/briefs/2026-10-zoneminder-sqli/Sat, 24 Oct 2026 04:05:34 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-10-zoneminder-sqli/An authenticated time-based blind SQL injection vulnerability in ZoneMinder versions up to 1.37.64 allows attackers to exfiltrate sensitive database information via the removetag action.CVE-2024-51482 is a time-based blind SQL injection vulnerability affecting ZoneMinder versions through 1.37.64. The flaw exists within the event management functionality of the application. An authenticated attacker can trigger this vulnerability by sending specially crafted requests to the /zm/index.php endpoint, specifically targeting the removetag action and the tid parameter. The vulnerability enables attackers to extract data from the backend database using conditional SLEEP payloads.

Impact

Successful exploitation allows authenticated attackers to perform database enumeration and dump sensitive information, including user credentials stored in the zm.Users table. The CVSS score for this vulnerability is 9.9.

Recommendation

  • Upgrade ZoneMinder to version 1.37.65 or later immediately to patch the vulnerability.
  • Audit access logs for authenticated users performing frequent or anomalous POST requests to /zm/index.php with the action=removetag parameter.
  • Restrict access to the ZoneMinder interface to trusted networks only.
]]>highadvisory