PT-2023-20439

CVE-2023-26037

Publicado

2023-02-25

Atualizado

2023-11-30

Descrição por

CVSS 3.1

9.8

Crítica

MétricasAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions ZoneMinder versions prior to 1.36.33 ZoneMinder versions prior to 1.37.33

Description The issue is related to an SQL Injection in ZoneMinder, a free, open source Closed-circuit television software application for Linux. The minTime and maxTime request parameters are not properly validated, allowing them to be used to execute arbitrary SQL.

Recommendations For versions prior to 1.36.33, update to version 1.36.33 or later. For versions prior to 1.37.33, update to version 1.37.33 or later.

Explorabilidade

Exploit

Correção

Impactos

Pesquisadores

Manfred Paul

Fornecedores

Produtos afetados

Enumeração de fraquezas

CWE-89: Improper Neutralization of Special Elements used in an SQL Command (\'SQL Injection\')

Identificadores relacionados

CVE-2023-26037