CVE-2024-51482
Boolean-based SQL Injection in ZoneMinder v1.37.* <= 1.37.64
- Published
- Oct 31, 2024
- Updated
- Nov 8, 2024
- Assigning CNA
- GitHub_M
- Evidence observed
- Aug 8, 2026
Primary CVSS
nvd · CVSS 3.1
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:HModerate · next 30 days
- Percentile
- 98.5%
- Model date
- Oct 17, 2026
EPSS is a statistical estimate, not a certainty or a measure of impact. Combine it with CVSS, KEV status, exposure and your environment.
Summary
ZoneMinder is a free, open source closed-circuit television software application. ZoneMinder v1.37.* <= 1.37.64 is vulnerable to boolean-based SQL Injection in function of web/ajax/event.php. This is fixed in 1.37.65.
Sources
http/cves/2024/CVE-2024-51482.yaml
Nuclei TemplatesDeclared conditions
- network: http($.protocol_keys)
- verification: dsl,word($.matchers[*].type)
- CVE-2024-51482Exploit
ZenoMinder Blind SQL Injection PoC
CVE-2024-51482 ZoneMinder v1.37.* <= 1.37.64 poc
CVE-2025-51482 POC, Dump Credentials From zm.Users
Authenticated time-based blind SQL injection PoC for ZoneMinder CVE-2024-51482 (v1.37.* <= 1.37.64)
ZoneMinder Time-Based SQL Injection (CVE-2024-51482) Exploit POC
- CVE-2024-51482-POCExploit
Time-based SQL injection PoC for CVE-2024-51482 in ZoneMinder, with reproducible Docker lab and automated data extraction.
Scripts en Python para la explotación de CVE-2024-51482 (SQLi en ZoneMinder) — HTB CCTV
Performing multiple time-based blind injections for the same character and selecting the most frequent result significantly reduces errors and improves reliability, through it is time-consuming.
Responsible use
Use vulnerability information only on systems you own or are authorized to test. Kitploit links to public research metadata and does not store exploit code or malicious payloads.