Skip to content

SQL injection in report_event_audit

High
connortechnology published GHSA-65jp-2hj3-3733 Feb 24, 2023

Package

zoneminder (ZoneMinder)

Affected versions

< 1.36.33, < 1.37.33

Patched versions

1.36.33, 1.37.33

Description

Impact

minTime and maxTime requests parameters were not properly validated and could be used execute arbitrary SQL.

Patches

Fixed by 4f4ddaa. Fix release in 1.36.33 or 1.37.33.

Workarounds

Apply patch manually.

Credits

Manfred Paul
SamXML

Severity

High

CVE ID

CVE-2023-26037

Weaknesses

No CWEs