CVE-2023-41884: 
NixOS vulnerability analysis and mitigation

ZoneMinder, a free open-source Closed-circuit television software application, was found to contain a SQL injection vulnerability (CVE-2023-41884). The vulnerability exists in WWW/AJAX/watch.php, Line: 51, where several parameters in SQL queries are processed without proper sanitization. This security issue was discovered on August 12, 2024, and has been fixed in version 1.36.34 (GitHub Advisory).

The vulnerability is classified as a SQL injection (CWE-89) with a CVSS v3.1 base score of 7.1 HIGH (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N). The issue specifically affects the sort parameter in watch.php, where user input is directly incorporated into SQL queries without proper validation or sanitization. This vulnerability can be exploited through network access with low attack complexity, requiring low privileges and no user interaction (GitHub Advisory, NVD).

The vulnerability allows attackers to manipulate SQL queries, potentially leading to unauthorized access to database information. The impact assessment indicates high confidentiality impact and low integrity impact, with no effect on system availability (GitHub Advisory).

The vulnerability can be exploited by sending crafted HTTP requests containing malicious SQL payloads through the sort parameter. A proof of concept exists demonstrating the ability to trigger database sleep commands through specially crafted requests (GitHub Advisory).

The vulnerability has been patched in ZoneMinder version 1.36.34. The fix includes implementing proper validation of the sort parameter by checking it against an allowlist of valid column names (GitHub Commit).