FKIE_CVE-2026-27470

Vulnerability from fkie_nvd - Published: 2026-02-21 08:16 - Updated: 2026-02-24 14:48
Severity ?
8.8 (High) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Summary
ZoneMinder is a free, open source closed-circuit television software application. In versions 1.36.37 and below and 1.37.61 through 1.38.0, there is a second-order SQL Injection vulnerability in the web/ajax/status.php file within the getNearEvents() function. Event field values (specifically Name and Cause) are stored safely via parameterized queries but are later retrieved and concatenated directly into SQL WHERE clauses without escaping. An authenticated user with Events edit and view permissions can exploit this to execute arbitrary SQL queries.
References
security-advisories@github.comhttps://github.com/ZoneMinder/zoneminder/releases/tag/1.36.38Product, Release Notes
security-advisories@github.comhttps://github.com/ZoneMinder/zoneminder/releases/tag/1.38.1Product, Release Notes
security-advisories@github.comhttps://github.com/ZoneMinder/zoneminder/security/advisories/GHSA-r6gm-478g-f2c4Exploit, Mitigation, Vendor Advisory
security-advisories@github.comhttps://owasp.org/www-community/attacks/SQL_InjectionNot Applicable
Impacted products
Vendor Product Version
zoneminder zoneminder *
zoneminder zoneminder *
To clipboard 

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:zoneminder:zoneminder:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "464C2B6D-B9E6-429B-A894-099EC5A3F552",
              "versionEndExcluding": "1.36.38",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:zoneminder:zoneminder:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "EFEBDB7E-89B6-41EB-934B-2C1F214D1A91",
              "versionEndExcluding": "1.38.1",
              "versionStartIncluding": "1.37.61",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "ZoneMinder is a free, open source closed-circuit television software application. In versions 1.36.37 and below and 1.37.61 through 1.38.0, there is a second-order SQL Injection vulnerability in the web/ajax/status.php file within the getNearEvents() function. Event field values (specifically Name and Cause) are stored safely via parameterized queries but are later retrieved and concatenated directly into SQL WHERE clauses without escaping. An authenticated user with Events edit and view permissions can exploit this to execute arbitrary SQL queries."
    },
    {
      "lang": "es",
      "value": "ZoneMinder es una aplicaci\u00f3n de software de televisi\u00f3n de circuito cerrado gratuita y de c\u00f3digo abierto. En las versiones 1.36.37 e inferiores y de la 1.37.61 hasta la 1.38.0, existe una vulnerabilidad de inyecci\u00f3n SQL de segundo orden en el archivo web/ajax/status.php dentro de la funci\u00f3n getNearEvents(). Los valores de los campos de evento (espec\u00edficamente Nombre y Causa) se almacenan de forma segura mediante consultas parametrizadas, pero luego se recuperan y se concatenan directamente en las cl\u00e1usulas SQL WHERE sin escapar. Un usuario autenticado con permisos de edici\u00f3n y visualizaci\u00f3n de Eventos puede explotar esto para ejecutar consultas SQL arbitrarias."
    }
  ],
  "id": "CVE-2026-27470",
  "lastModified": "2026-02-24T14:48:36.060",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 8.8,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 5.9,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ]
  },
  "published": "2026-02-21T08:16:12.197",
  "references": [
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Product",
        "Release Notes"
      ],
      "url": "https://github.com/ZoneMinder/zoneminder/releases/tag/1.36.38"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Product",
        "Release Notes"
      ],
      "url": "https://github.com/ZoneMinder/zoneminder/releases/tag/1.38.1"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Exploit",
        "Mitigation",
        "Vendor Advisory"
      ],
      "url": "https://github.com/ZoneMinder/zoneminder/security/advisories/GHSA-r6gm-478g-f2c4"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Not Applicable"
      ],
      "url": "https://owasp.org/www-community/attacks/SQL_Injection"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-89"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Primary"
    }
  ]
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.