p PatchFirst

CVE-2023-41884

CVE-2023-41884 · ZoneMinder Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in watch.php

This page contains facts from public vulnerability sources. Check the original advisory before updating.

ZoneMinder is a free, open source Closed-circuit television software application. In WWW/AJAX/watch.php, Line: 51 takes a few parameter in sql query without sanitizing it which makes it vulnerable to sql injection. This vulnerability is fixed in 1.36.34.

CVSS 7.1 · High · EPSS 0.5% · Fix available

Published
Updated

Stack: system

Affected products and versions

  • zoneminder

    Versions
    • < 1.36.34: Affected

    No fix published

  • zoneminder Debian:12

    Versions
    • 1.36.33+dfsg1-1
    • 1.36.35+dfsg1-1
    • 1.36.37+dfsg1-1
    • 1.36.37+dfsg1-1.1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • zoneminder Debian:13

    Affected ranges
    • ECOSYSTEM: < 1.36.35+dfsg1-1

    Update to 1.36.35+dfsg1-1

  • zoneminder Debian:14

    Affected ranges
    • ECOSYSTEM: < 1.36.35+dfsg1-1

    Update to 1.36.35+dfsg1-1

  • zoneminder Ubuntu:Pro:16.04:LTS

    Versions
    • 1.28.1-8
    • 1.29.0+dfsg-1
    • 1.29.0+dfsg-1ubuntu1
    • 1.29.0+dfsg-1ubuntu2
    • 1.29.0+dfsg-1ubuntu2+esm1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • zoneminder Ubuntu:Pro:20.04:LTS

    Versions
    • 1.32.3-2build1
    • 1.32.3-2ubuntu1
    • 1.32.3-2ubuntu2
    • 1.32.3-2ubuntu2+esm1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • zoneminder Ubuntu:Pro:22.04:LTS

    Versions
    • 1.36.7+dfsg1-1
    • 1.36.10+dfsg1-1
    • 1.36.11+dfsg1-1
    • 1.36.12+dfsg1-1
    • 1.36.12+dfsg1-1ubuntu0.1~esm1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • zoneminder Ubuntu:24.04:LTS

    Versions
    • 1.36.33+dfsg1-1build1
    • 1.36.33+dfsg1-1build2
    • 1.36.33+dfsg1-1build3
    • 1.36.33+dfsg1-1build4
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • zoneminder Ubuntu:25.10

    Versions
    • 1.36.35+dfsg1-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • zoneminder Ubuntu:26.10

    Versions
    • 1.36.37+dfsg1-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • zoneminder Ubuntu:26.04:LTS

    Versions
    • 1.36.35+dfsg1-1
    • 1.36.37+dfsg1-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

Original sources

Check your server →