CVE-2023-26032 HIGH

CVE-2023-26032: ZoneMinder contains SQL injection via malicious Jason Web Token

Vendor Zoneminder
Product zoneminder
Weakness CWE-89 · SQLi
Published February 25, 2023
Last update March 10, 2025
View on NVD All CVEs

CVSS base score

8.9/10
Attack vector Network
Attack complexity High
Privileges required None
User interaction None
Confidentiality High
Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:L

What the vulnerability does

01Description

ZoneMinder is a free, open source Closed-circuit television software application for Linux which supports IP, USB and Analog cameras. Versions prior to 1.36.33 and 1.37.33 contain SQL Injection via malicious jason web token. The Username field of the JWT token was trusted when performing an SQL query to load the user. If an attacker could determine the HASH key used by ZoneMinder, they could generate a malicious JWT token and use it to execute arbitrary SQL. This issue is fixed in versions 1.36.33 and 1.37.33.

Key dates

02Disclosure timeline

February 25, 2023 CVE published
March 10, 2025 Record updated