CVE-2019-8428

Name of the Vulnerable Software and Affected Versions ZoneMinder versions prior to 1.32.3

Description The issue allows for SQL Injection via the groupSql parameter in the skins/classic/views/control.php file, as demonstrated by a newGroup[MonitorIds][] value. This can be exploited through the API endpoint /skins/classic/views/control.php. The vulnerable parameter is newGroup[MonitorIds][].

Recommendations For versions prior to 1.32.3, update to version 1.32.3 or later to resolve the issue. As a temporary workaround, consider restricting access to the skins/classic/views/control.php file to minimize the risk of exploitation. Avoid using the newGroup[MonitorIds][] parameter in the affected API endpoint until the issue is resolved.