Exploitation Summary
EIP tracks 4 public exploits for CVE-2026-27470. PoCs published by XiaomingX, kocaemre, XZ1r0.
AI-analyzed exploit summary This repository contains a functional proof-of-concept exploit for CVE-2026-27470, a second-order SQL injection vulnerability in ZoneMinder. The exploit demonstrates how an authenticated attacker can extract arbitrary data from the database by leveraging a stored payload in the event name field.
Description
ZoneMinder is a free, open source closed-circuit television software application. In versions 1.36.37 and below and 1.37.61 through 1.38.0, there is a second-order SQL Injection vulnerability in the web/ajax/status.php file within the getNearEvents() function. Event field values (specifically Name and Cause) are stored safely via parameterized queries but are later retrieved and concatenated directly into SQL WHERE clauses without escaping. An authenticated user with Events edit and view permissions can exploit this to execute arbitrary SQL queries.
Exploits (4)
This repository contains a functional proof-of-concept exploit for CVE-2026-27470, a second-order SQL injection vulnerability in ZoneMinder. The exploit demonstrates how an authenticated attacker can extract arbitrary data from the database by leveraging a stored payload in the event name field.
This repository contains a functional proof-of-concept exploit for CVE-2026-27470, a second-order SQL injection vulnerability in ZoneMinder. The exploit demonstrates how an authenticated attacker can extract arbitrary data from the database by leveraging a stored payload in the Events.Name field.
This repository contains a functional Python-based exploit for CVE-2026-27470, a second-order SQL injection vulnerability in ZoneMinder. The exploit demonstrates the two-phase attack: first injecting a payload into an event's Name or Cause field via a parameterized query, then triggering the injection by invoking the vulnerable `getNearEvents()` function, which unsafely concatenates the stored payload into a new SQL query.
This repository contains a functional exploit PoC for CVE-2026-27470, a second-order SQL injection vulnerability in ZoneMinder's `getNearEvents()` function. The exploit demonstrates how an attacker can store a malicious payload in an event's Name or Cause field and later trigger it via the status API to execute arbitrary SQL queries.
References (4)
Scores
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H