PT-2024-9833 · Unknown+2 · Zoneminder+2

Blackh4N · Published 2024-08-12 · Updated 2024-10-08 · CVE-2024-43360

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: ZoneMinder versions 1.36.33 through 1.37.43 ZoneMinder versions prior to 1.36.34 ZoneMinder versions prior to 1.37.61

Description: ZoneMinder is affected by a time-based SQL Injection vulnerability. The issue stems from improper sanitization of user input in the sort and mid parameters of the "/zm/index.php" endpoint. This vulnerability can allow an attacker to execute arbitrary code.

Recommendations: For ZoneMinder versions 1.36.33 through 1.37.43, update to version 1.36.34 or later. For ZoneMinder versions prior to 1.37.61, update to version 1.37.61 or later. As a temporary workaround, consider restricting access to the "/zm/index.php" endpoint until a patch is available. Avoid using the sort and mid parameters in the affected API endpoint until the issue is resolved.

Exploit

Fix

SQL injection

Buffer Overflow

Weakness Enumeration

CWE-89

CWE-119

Related Identifiers

ALT-PU-2024-11690

ALT-PU-2024-11765

ALT-PU-2024-12153

ALT-PU-2024-12804

BDU:2024-11611

CVE-2024-43360

GHSA-9CMR-7437-V9FJ

Affected Products

Alt Linux

Debian

Zoneminder

References · 27

• 🔥 https://github.com/ZoneMinder/zoneminder/security/advisories/GHSA-9cmr-7437-v9fj · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/43xxx/CVE-2024-43360.json · Exploit
• https://github.com/ZoneMinder/zoneminder/commit/de8f387207e9c506e8e8007eda725741a25601c5 · Patch
• https://github.com/ZoneMinder/zoneminder/commit/677f6a31551f128554f7b0110a52fd76453a657a · Patch
• https://github.com/ZoneMinder/zoneminder/commit/bb07118118e23b5670c2c18be8be2cc6b8529397 · Patch
• https://github.com/ZoneMinder/zoneminder/commit/a194fe81d34c5eea2ab1dc18dc8df615fca634a6 · Patch
• https://osv.dev/vulnerability/CVE-2024-43360 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2024-43360 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2024-43360 · Security Note
• https://ubuntu.com/security/CVE-2024-43360 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-43360 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2024-43360 · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-11611 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2024-43360 · Vendor Advisory
• https://t.me/cvedetector/2900 · Telegram Post