An authenticated SQL injection vulnerability in ZoneMinder allows attackers with specific event permissions to compromise database integrity and potentially execute arbitrary commands.

This is a second-order SQL injection flaw occurring in the getNearEvents() function within the web/ajax/status.php file. The vulnerability is triggered by an authenticated user who possesses Events edit and view permissions, as the application fails to properly escape data retrieved from storage before concatenating it into SQL queries.

Successful exploitation of this SQL injection vulnerability permits an authenticated attacker to manipulate database queries, leading to unauthorized data exfiltration, modification, or deletion of sensitive monitoring data. Given the CVSS score of 8.8, this vulnerability represents a high risk to organizational security, particularly because it could facilitate broader system compromise or unauthorized access to the underlying server environment.

Immediate Action: Upgrade ZoneMinder to version 1.36.38 or 1.38.1 immediately to incorporate the necessary security patches.

Proactive Monitoring: Review web access logs for unusual patterns or suspicious SQL syntax in requests directed at the web/ajax/status.php endpoint.

Compensating Controls: Implement Web Application Firewall (WAF) rules designed to detect and block common SQL injection payloads, particularly those targeting the mentioned PHP file, as a temporary measure until patching is complete.

Public Exploit Available: Yes, multiple public proofs-of-concept exist on GitHub.

This vulnerability presents a significant risk to the integrity of the ZoneMinder surveillance environment. Administrators should prioritize updating the software to the specified fixed versions to eliminate the underlying flaw. Given the availability of public proof-of-concept code, delaying remediation significantly increases the probability of successful exploitation by threat actors.