CVE-2024-43360

published 2024-08-12

CVE-2024-43360: ZoneMinder is a free, open source closed-circuit television software application. ZoneMinder is affected by a time-based SQL Injection vulnerability. This…

Priority P1 81 critical 9.8 CVSS 3.1

AV N AC L PR N UI N S U C H I H A H

ITW EXPLOIT VulnCheck KEV

ZoneMinder is a free, open source closed-circuit television software application. ZoneMinder is affected by a time-based SQL Injection vulnerability. This vulnerability is fixed in 1.36.34 and 1.37.61.

Affected

6 ranges

Vendor	Product	Version range	Fixed in
debian	zoneminder	< zoneminder 1.36.35+dfsg1-1 (forky)	zoneminder 1.36.35+dfsg1-1 (forky)
zoneminder	zoneminder	< 1.36.34	1.36.34
zoneminder	zoneminder	—	—
zoneminder	zoneminder	>= 0 < 1.36.35+dfsg1-1	1.36.35+dfsg1-1
zoneminder	zoneminder	>= 0 < 1.36.35+dfsg1-1	1.36.35+dfsg1-1
zoneminder	zoneminder	>= 1.37.00 < 1.37.61	1.37.61

Detection & IOCs extracted from sources · hover to see the quote

url /zm/index.php?sort=if(now()=sysdate()%2Csleep(6)%2C0)&order=desc&limit=20&view=request&request=watch&mid=1

path /zm/index.php

command sort=if(now()=sysdate()%2Csleep(6)%2C0)&order=desc&limit=20&view=request&request=watch&mid=1

• → Detect time-based SQL injection attempts against ZoneMinder via the `sort` parameter in `/zm/index.php`. Look for payloads containing `if(now()=sysdate(),sleep(...)` in the query string.
• → Alert on HTTP responses to `/zm/index.php` with `view=request&request=watch` that take 6 or more seconds to respond — indicative of a successful time-based blind SQL injection sleep payload.
• → Successful exploitation returns HTTP 200 with a JSON body containing `result":"Ok"` and `rows":[`. Correlate slow response time (>=6s) with these response body patterns to confirm exploitation.
• → The vulnerable endpoint is unauthenticated (PR:N). Monitor for requests to `/zm/index.php` with `sort` parameter values containing SQL functions such as `sleep()`, `if()`, `now()`, or `sysdate()` from any source IP. ↗
• → FOFA fingerprint icon_hash=`-1218152116` can be used to identify exposed ZoneMinder instances for proactive scanning and asset inventory.

• · The Nuclei template uses a 20-second HTTP timeout (`@timeout 20s`) to accommodate the 6-second sleep payload. Detection rules or proxies with shorter timeouts may miss or drop the malicious request before the sleep completes, causing false negatives.
• · The exploit targets the `sort` query parameter specifically with `view=request&request=watch&mid=1`. Detection should not be limited to the `sort` parameter alone — other injectable parameters may exist in the same endpoint.

CVSS provenance

nvd v3.1 9.8 CRITICAL CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

osv 9.8 CRITICAL

vulncheck 9.8 CRITICAL

vendor_debian 9.8 LOW

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-89