CVE-2024-43360

CRITICAL EXPLOITED NUCLEI

ZoneMinder < 1.36.34 - Time-Based SQL Injection

Title source: llm

Exploitation Summary

CVE-2024-43360 has been observed exploited in the wild (reported by VulnCheck KEV). EIP tracks 1 public exploit from researchers including iSee857. A Nuclei detection template is also available.

AI-analyzed exploit summary The repository contains functional exploit code for CVE-2024-43360, demonstrating a command execution vulnerability in OpenCode. The script sends crafted requests to exploit the vulnerability and verify command execution via the 'id' command.

Description

ZoneMinder is a free, open source closed-circuit television software application. ZoneMinder is affected by a time-based SQL Injection vulnerability. This vulnerability is fixed in 1.36.34 and 1.37.61.

Exploits (1)

github WORKING POC 40 stars

by iSee857 · pythonpoc

https://github.com/iSee857/CVE-PoC/tree/main/ZoneMinder_CVE-2024-43360_SqlInjection.py

View Code ZIP pw:eip

The repository contains functional exploit code for CVE-2024-43360, demonstrating a command execution vulnerability in OpenCode. The script sends crafted requests to exploit the vulnerability and verify command execution via the 'id' command.

Classification

Working Poc 95%

Attack Type

Rce

Complexity

Moderate

Reliability

Reliable

Target: OpenCode

No auth needed

Prerequisites: Network access to the target · Target running vulnerable OpenCode instance

MITRE ATT&CK