BridgerAlderson/CVE-2024-51482

GitHubRepository PoCExploit

PoC files

2 files

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

GitHub
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

Python script that exploits CVE-2024-51482, a blind SQL injection in ZoneMinder, by authenticating, confirming vulnerability via time-based SLEEP, and extracting database schema and data using binary search.

Backdoor review

No backdoor observed in reviewed code

The PoC is a straightforward Python script that exploits CVE-2024-51482, a blind SQL injection in ZoneMinder, by sending time-based payloads to extract database contents. No backdoor, deceptive payload, or concealed operator-directed harm is present. The script only interacts with the user-supplied target and performs no unrelated network activity, persistence, or credential exfiltration.

ClassificationExploit
Model confidence100%
AuthenticationRequired
LanguagesPython
Target softwareZoneMinder
Attack typesSQL Injection
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The Python script actively exploits CVE-2024-51482 by sending crafted HTTP requests with SQL SLEEP payloads to extract database contents, going beyond detection to perform data exfiltration.

CVE-2024-51482.py:90-109CVE-2024-51482.py:138CVE-2024-51482.py:263-288

Requirements

  • Valid ZoneMinder credentials (default admin/admin)CVE-2024-51482.py:312-313
  • Network access to ZoneMinder web interfaceREADME.md:96
  • Target running ZoneMinder 1.37.0 - 1.37.64README.md:30

Observed behavior

  • Authenticates to ZoneMinder using supplied credentials to obtain a session cookieCVE-2024-51482.py:48-88
  • Measures baseline HTTP response time by sending normal requestsCVE-2024-51482.py:111-130
  • Confirms vulnerability by injecting a SLEEP payload and checking for delayed responseCVE-2024-51482.py:132-151
  • Extracts database names, tables, columns, and row data using time-based blind SQL injection with binary search over ASCII rangeCVE-2024-51482.py:153-204CVE-2024-51482.py:206-288
  • Dumps ZoneMinder Users table including usernames and password hashesCVE-2024-51482.py:290-302
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Exploit Behavior
Time-based blind SQL injection using SLEEP() payloads sent to the vulnerable ZoneMinder endpointThe script constructs SQL payloads with SLEEP() to infer data character-by-character via binary search. This is the expected exploit behavior for the stated CVE.CVE-2024-51482.py:138-139CVE-2024-51482.py:159-162
Target Interaction
All HTTP requests are directed to the user-supplied target IPThe base URL is constructed from the --ip argument, and no other hosts are contacted. This confines the exploit to the intended target.CVE-2024-51482.py:33CVE-2024-51482.py:92
Credential Usage
Username and password are used only for ZoneMinder login on the targetCredentials are sent exclusively to the target's login endpoint and are not exfiltrated elsewhere.CVE-2024-51482.py:54-60
Review boundaries

What the analysis did not establish

  • Evidence does not include execution results; classification is based solely on static code analysis of the provided text files.
  • The artifact's complete_artifact_coverage is false, indicating the repository snapshot may contain additional files not included in this packet.
  • Only the two text files (CVE-2024-51482.py and README.md) were provided; no other files exist in the repository snapshot.
  • The review does not assess the safety of the target system or the legality of using the exploit.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Linked vulnerabilities

1