CVE-2024-51482

ZoneMinder, a free and open-source CCTV/video surveillance application, contains a boolean-based (blind) SQL injection vulnerability in web/ajax/event.php. All 1.37-series releases up to and including 1.37.64 are affected; an attacker with low-privilege access (per the CVSS vector, PR:L, implying some level of authentication) sends crafted input to this AJAX endpoint, where unsanitized input is incorporated into a SQL query. Because the injection is boolean-based, the attacker can infer database contents by observing differences between true/false responses, potentially reading or altering data such as events and camera records; the CVSS 9.9 rating with scope change (C:H/I:H/A:H) indicates high impact across confidentiality, integrity, and availability. Anyone running ZoneMinder 1.37.64 or earlier is affected, with typical deployments being self-hosted NVR servers at homes and small organizations; the available data does not state whether the separate 1.36 stable series is also affected. No public proof-of-concept or confirmed in-the-wild exploitation is known, but EPSS assigns a 35% probability of exploitation within the next 30 days (98th percentile), so rapid patching is warranted.

What to do: Upgrade ZoneMinder to version 1.37.65 or later immediately. Until patched, restrict access to the ZoneMinder web interface (especially web/ajax/event.php) to authenticated, trusted users and avoid exposing it directly to the internet, placing it behind a VPN or reverse proxy with access controls if possible. Although the flaw is not yet in CISA KEV and no public PoC is known, the 35% EPSS score suggests checking logs for anomalous requests to event.php and prioritizing this patch within your normal critical-update cycle.