CVE-2026-27470
📋 TL;DR
ZoneMinder versions 1.36.37 and below and 1.37.61 through 1.38.0 contain a second-order SQL injection vulnerability in the web/ajax/status.php file. Authenticated users with Events edit and view permissions can exploit this to execute arbitrary SQL queries against the database. This affects all deployments running vulnerable versions of ZoneMinder.
💻 Affected Systems
- ZoneMinder
📦 What is this software?
Zoneminder by Zoneminder
Zoneminder by Zoneminder
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise including data exfiltration, modification, or deletion; potential privilege escalation to system-level access; installation of persistent backdoors.
Likely Case
Unauthorized access to surveillance data, manipulation of event logs, extraction of user credentials, and potential lateral movement within the network.
If Mitigated
Limited to authenticated user's permissions scope; database integrity maintained through proper input validation and parameterized queries.
🎯 Exploit Status
Exploitation requires authenticated access and specific permissions. Second-order SQL injection requires understanding of the application flow.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.36.38 or 1.38.1
Vendor Advisory: https://github.com/ZoneMinder/zoneminder/security/advisories/GHSA-r6gm-478g-f2c4
Restart Required: Yes
Instructions:
1. Backup your ZoneMinder database and configuration files. 2. Download the patched version from GitHub releases. 3. Follow the ZoneMinder upgrade documentation for your specific installation method. 4. Restart the ZoneMinder service and web server.
🔧 Temporary Workarounds
Restrict User Permissions
allTemporarily remove Events edit and view permissions from non-essential users to reduce attack surface.
# Edit ZoneMinder user permissions via web interface or database
Web Application Firewall Rules
linuxImplement WAF rules to block SQL injection patterns targeting the /web/ajax/status.php endpoint.
# Example ModSecurity rule: SecRule REQUEST_URI "@contains /web/ajax/status.php" "id:1001,phase:2,deny,status:403,msg:'Blocking SQLi attempt'"
# Add SQL injection detection patterns
🧯 If You Can't Patch
- Implement strict network segmentation to isolate ZoneMinder from critical systems
- Enable comprehensive logging and monitoring for SQL injection attempts and unusual database queries
🔍 How to Verify
Check if Vulnerable:
Check ZoneMinder version via web interface (Options -> About) or command line: grep ZM_VERSION /usr/share/zoneminder/includes/version.phpCheck Version:
grep ZM_VERSION /usr/share/zoneminder/includes/version.phpVerify Fix Applied:
Verify version is 1.36.38 or higher, or 1.38.1 or higher. Test the vulnerable endpoint with safe SQL injection test payloads.📡 Detection & Monitoring
Log Indicators:
- Unusual SQL queries in database logs
- Multiple failed login attempts followed by successful authentication
- Requests to /web/ajax/status.php with SQL keywords in parameters
Network Indicators:
- Unusual database connection patterns from ZoneMinder application server
- Large data transfers from database to unexpected destinations
SIEM Query:
source="zoneminder.logs" AND (uri="/web/ajax/status.php" AND (keywords="SELECT", "UNION", "INSERT", "UPDATE", "DELETE"))