Description
ZoneMinder是一款免费的开源闭路电视软件应用程序，支持IP、USB和模拟摄像机等。受影响版本中，/zm/index.php中的sort参数存在SQL注入漏洞，攻击者可通过构造包含恶意sort参数的请求获取服务器敏感信息。该漏洞允许基于时间的SQL注入攻击，可能导致敏感数据泄露或其他恶意操作。
ZoneMinder /zm/index.php watch SQL 注入漏洞（CVE-2024-43360）
PoC
None yet. Search at https://trap.biu.life/?ref=rssReferences
https://nvd.nist.gov/vuln/detail/CVE-2024-43360
https://github.com/ZoneMinder/zoneminder/security/advisories/GHSA-9cmr-7437-v9fj
https://medium.com/techpioneers/cve-2024-43360-in-depth-analysis-and-implications-for-security-75ceccc746b4
https://ubuntu.com/security/CVE-2024-43360
https://pentest-tools.com/vulnerabilities-exploits/zoneminder-sql-injection_23697
https://asec.ahnlab.com/en/82639/
https://security.snyk.io/vuln/SNYK-DEBIANUNSTABLE-ZONEMINDER-7678544
https://www.cve.org/CVERecord?id=CVE-2024-43360
https://cvefeed.io/vuln/detail/CVE-2024-43360