CVE-2024-51482

This repository contains a functional Python-based exploit for CVE-2024-51482, a time-based blind SQL injection vulnerability in ZoneMinder v1.37.* <= 1.37.64. The exploit includes authentication handling, multi-threaded data extraction, and various enumeration options for databases, tables, and columns.

This is a detailed technical writeup describing a multi-stage exploitation chain involving SQL Injection (CVE-2024-51428) in ZoneMinder and Remote Code Execution in motionEye. It includes root cause analysis, patch recommendations, and step-by-step exploitation details.

This repository contains a functional Python-based exploit for CVE-2024-51482, a blind SQL injection vulnerability in ZoneMinder. The exploit includes authentication, baseline timing measurement, vulnerability verification, and data extraction capabilities.

This repository contains a functional Python-based SQL injection exploit for CVE-2024-51482, targeting ZoneMinder versions 1.37 to 1.37.64. The exploit uses time-based blind SQL injection with optimized character extraction and parallel processing to dump user credentials from the database.

This repository contains a functional Python script for exploiting CVE-2024-51482, a time-based SQL injection vulnerability in ZoneMinder. The script automates database extraction, table enumeration, and data dumping using concurrent requests for efficiency.

This repository contains a functional proof-of-concept exploit for CVE-2024-51482, a boolean-based SQL injection vulnerability in ZoneMinder versions 1.37.* up to 1.37.64. The exploit targets the web/ajax/event.php endpoint and allows for database enumeration, including extracting usernames and password hashes from the Users table.