lnn0v4/sqli-hunter-cve-2024-51482-pocScripts en Python para la explotación de CVE-2024-51482 (SQLi en ZoneMinder) — HTB CCTV
Python scripts for exploiting CVE-2024-51482 (SQLi in ZoneMinder) — HTB CCTV sqli-hunter — CVE-2024-51482
This script automates the extraction of databases, tables, columns, and credentials by exploiting CVE-2024-51482, a Boolean-based SQL Injection vulnerability in the tid parameter of the removetag endpoint of ZoneMinder ≤ 1.37.64. The vulnerable code in web/ajax/event.php directly inserts $_REQUEST['tid'] into an SQL query without sanitization
case 'removetag':
$tagId = $_REQUEST['tid'];
$sql = "SELECT * FROM Events_Tags WHERE TagId = $tagId"; // ← vulnerable
$rowCount = dbNumRows($sql);
-Python 3.x
-pwntools
git clone https://github.com/lnn0v4/sqli-hunter-CVE-2024-51482-PoC.git
cd sqli-hunter-CVE-2024-51482-PoC
python3 -m venv venv
source venv/bin/activate
pip install pwntools
URL = "http://cctv.htb/zm/index.php?view=request&request=event&action=removetag&tid="
COOKIE = {"ZMSESSID": "TU_COOKIE_AQUI"}
python3 CVE-2024-51482.py
✅ Automatic baseline latency detection
✅ ASCII binary search (7x faster than brute force)
✅ Parallel extraction with threads (ThreadPoolExecutor)
✅ Interactive menu: DB → Tables → Columns → Data
✅ Column cache to avoid re-extraction
✅ Navigate between tables without restarting the script
⚠️ This script is for educational purposes only and for use in authorized environments such as HackTheBox. Do not use this code on systems without explicit authorization.
MIT License