Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.8
CVE-2019-8423: ZoneMinder allows attackers to run database commands
CVE-2019-8423 · published 7 years ago
Summary
The ZoneMinder video surveillance system (up to version 1.32.3) does not properly validate a value entered on a web page, which lets a remote attacker insert their own commands into the database. This could let the attacker view, modify, or delete video records and potentially take control of the server. Install the latest security update from your package source or upgrade to a newer version that fixes the problem.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Debian:12 | debian | zoneminder | All versions |
| Debian:13 | debian | zoneminder | All versions |
| Debian:14 | debian | zoneminder | All versions |
| – | zoneminder | zoneminder |
<= 1.32.3 cpe:2.3:a:zoneminder:zoneminder:*:*:*:*:*:*:*:* |
Original advisory text
ZoneMinder through 1.32.3 has SQL Injection via the skins/classic/views/events.php filter[Query][terms][0][cnj] parameter.
ZoneMinder through 1.32.3 has SQL Injection via the skins/classic/views/events.php filter[Query][terms][0][cnj] parameter.
References
- https://security-tracker.debian.org/tracker/CVE-2019-8423 Vendor Advisory
- https://github.com/LoRexxar/CVE_Request/tree/master/zoneminder%20vul%20before%20... Exploit Issue Tracking Third Party Advisory
- https://www.seebug.org/vuldb/ssvid-97761 Permissions Required Third Party Advisory
Severity
9.8
Critical
Type
CWE-89SQL Injection
Timeline
Published18 Feb 2019
Updated3 Nov 2026
First seen21 Sep 2026
Track software like this
Free during beta