PT-2019-19025

CVE-2019-8423

·

Published

2019-02-18

·

Updated

2026-10-31

Description by

CVSS 3.1
9.8
Critical
MetricsAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions ZoneMinder versions prior to 1.32.4
Description The issue allows for SQL Injection via the skins/classic/views/events.php endpoint, specifically through the filter[Query][terms][0][cnj] parameter.
Recommendations For ZoneMinder versions prior to 1.32.4, update to version 1.32.4 or later to resolve the issue.
Exploitability
Exploit
Fix
Impacts
Researchers
Vendors
Affected products
Weakness enumeration
CWE-89: Improper Neutralization of Special Elements used in an SQL Command (\'SQL Injection\')
Related identifiers
CVE-2019-8423
ALT-PU-2020-1092
ALT-PU-2020-1246
CLEANSTART-2023-BN52857
Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com