Description
ZoneMinder is a free, open source closed-circuit television software application. ZoneMinder v1.37.* <= 1.37.64 is vulnerable to boolean-based SQL Injection in function of web/ajax/event.php. This is fixed in 1.37.65.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| ZoneMinder | zoneminder | >= 1.37.0, < 1.37.65 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | zoneminder | No fix yet | — |
| Ubuntu 25.10 | zoneminder | No fix yet | — |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
GitHub 9 repositories
-
plur1bu5/CVE-2024-51482-PoC ★ 14 · Mar 7, 2026
Authenticated time-based blind SQL injection PoC for ZoneMinder CVE-2024-51482 (v1.37.* <= 1.37.64)
-
BridgerAlderson/CVE-2024-51482 ★ 8 · Mar 8, 2026
ZenoMinder Blind SQL Injection PoC
-
0xDaeras/CVE-2024-51482-POC ★ 7 · Apr 28, 2026
Time-based SQL injection PoC for CVE-2024-51482 in ZoneMinder, with reproducible Docker lab and automated data extraction.
-
BwithE/CVE-2024-51482 ★ 1 · Jun 7, 2025
CVE-2024-51482 ZoneMinder v1.37.* <= 1.37.64 poc
-
diamorphine666/CVE-2024-51482 ★ 0 · Oct 3, 2026
ZoneMinder v1.37.* - SQL Injection
-
c0gnit00/CVE-2024-51482 ★ 0 · Jul 10, 2026
CVE-2025-51482 POC, Dump Credentials From zm.Users
-
ehl0707/CVE-2024-51482-ZoneMinder-CCTV-HTB-Reliable-EXP ★ 0 · Mar 19, 2026
Performing multiple time-based blind injections for the same character and selecting the most frequent result significantly reduces errors and improves reliability, through it is time-consuming.
-
lnn0v4/sqli-hunter-CVE-2024-51482-PoC ★ 0 · Mar 11, 2026
Scripts en Python para la explotación de CVE-2024-51482 (SQLi en ZoneMinder) — HTB CCTV
-
Ravi-lk/CVE-2024-51482-ZoneMinder-SQL-Injection-POC ★ 0 · Mar 8, 2026
ZoneMinder Time-Based SQL Injection (CVE-2024-51482) Exploit POC
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Automated scanner template
A ready-made Nuclei template detects this vulnerability automatically. Vulnerabilities with public scanner templates are typically probed across the internet soon after the template appears — exposed systems should be patched first.
- ZoneMinder v1.37.* <= 1.37.64 - SQL Injection http/cves/2024/CVE-2024-51482.yaml
Source: projectdiscovery/nuclei-templates (MIT) — updated daily. Only links are listed.