Unrated severityNVD Advisory· Published Aug 12, 2024· Updated Aug 13, 2024
ZoneMinder Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in watch.php
CVE-2023-41884
Description
ZoneMinder is a free, open source Closed-circuit television software application. In WWW/AJAX/watch.php, Line: 51 takes a few parameter in sql query without sanitizing it which makes it vulnerable to sql injection. This vulnerability is fixed in 1.36.34.
Affected products
2<1.36.34+ 1 more
- (no CPE)range: <1.36.34
- (no CPE)range: < 1.36.34
Patches
Vulnerability mechanics
References
3- github.com/ZoneMinder/zoneminder/commit/677f6a31551f128554f7b0110a52fd76453a657amitrex_refsource_MISC
- github.com/ZoneMinder/zoneminder/commit/a194fe81d34c5eea2ab1dc18dc8df615fca634a6mitrex_refsource_MISC
- github.com/ZoneMinder/zoneminder/security/advisories/GHSA-2qp3-fwpv-mc96mitrex_refsource_CONFIRM
News mentions
0No linked articles in our index yet.