CVE-2024-43360 ZoneMinder Time-based SQL Injection

Critical 9.8 Published 12 Aug 2024 Updated 15 Aug 2024

Attackers can exploit a time-based SQL injection in ZoneMinder to read sensitive data or potentially execute code.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2024-43360?

CVE-2024-43360 is a critical SQL injection vulnerability in Zoneminder Zoneminder, published on 12 Aug 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

ZoneMinder is a free, open source closed-circuit television software application. ZoneMinder is affected by a time-based SQL Injection vulnerability. This vulnerability is fixed in 1.36.34 and 1.37.61.

Weakness: CWE-89

Which versions are affected by CVE-2024-43360?

It affects 1 product.

Products include Zoneminder Zoneminder.

How do I fix CVE-2024-43360?

Upgrade to a fixed version.

Use parameterised queries everywhere and never build SQL by joining strings. Upgrade affected software first; a web application firewall only buys time. More about SQL injection.

Is CVE-2024-43360 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-43360 exists.

Public exploit code: 1 Nuclei template.

All Zoneminder Zoneminder vulnerabilities

Sources

Also known as DEBIAN-CVE-2024-43360, GHSA-9cmr-7437-v9fj, UBUNTU-CVE-2024-43360.