CVE-2026-27470: 
NixOS vulnerability analysis and mitigation

CVE-2026-27470 is a second-order SQL injection vulnerability in ZoneMinder, a free and open-source CCTV software application. The flaw exists in web/ajax/status.php within the getNearEvents() function, where event field values (Name and Cause) stored safely via parameterized queries are later retrieved and concatenated directly into SQL WHERE clauses without escaping. Affected versions include 1.36.37 and below, and 1.37.61 through 1.38.0. The vulnerability was discovered on 2026-01-27 via source code review by researcher Albert Corzo (Acorzo1983), reported to ZoneMinder the same day, and publicly disclosed on 2026-02-19 via a GitHub Security Advisory. It carries a CVSS v3.1 base score of 8.8 (High) (GitHub Advisory, Feedly).

The root cause is CWE-89 (SQL Injection), specifically a second-order (stored) injection pattern (CWE-564). Event Name and Cause fields are written to the database using safe parameterized queries in web/ajax/event.php (lines 161 and 168–169), but when getNearEvents() in web/ajax/status.php (lines 518–527 and 543–552) retrieves these values, it concatenates $event[$_REQUEST['sort_field']] directly into SQL WHERE clauses using string interpolation rather than parameterized placeholders. The attacker controls which event field is used via the sort_field request parameter; while $sortColumn (the SQL column reference) is safely whitelisted, the sort_field value itself is not restricted, allowing an attacker to select the Name or Cause field they control. Exploitation requires authentication with Events edit and view permissions, but no user interaction and no elevated privileges beyond that (GitHub Advisory).

Successful exploitation allows an authenticated attacker to execute arbitrary SQL queries against the ZoneMinder database, enabling full confidentiality, integrity, and availability compromise. An attacker can extract sensitive database content including user credential hashes, API keys, monitor configurations, and event data; modify or delete records; and potentially create new administrative accounts or escalate privileges. Heavy or malformed queries could also cause denial of service. The risk is particularly significant in multi-user ZoneMinder deployments where multiple users hold Events permissions (GitHub Advisory, Feedly).

Public proof-of-concept (PoC) exploit code is available on GitHub at https://github.com/kocaemre/CVE-2026-27470, added on 2026-03-02, and the original GitHub Security Advisory also contains a detailed PoC walkthrough. As of the time of reporting, there is no confirmed evidence of in-the-wild exploitation. The vulnerability is detectable by Nessus (plugin ID 299728). The EPSS score is approximately 0.032% (0.000320), indicating a currently low probability of exploitation in the wild. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No specific threat actor attribution has been reported (GitHub Advisory, Feedly, PoC GitHub).

1. Authenticate: Log in to the ZoneMinder web interface as a user with Events edit and view permissions.
2. Store malicious payload (Name field): Send a POST request to rename an existing event, embedding a SQL injection payload as the event name:

   POST /ajax/event.php HTTP/1.1
   Content-Type: application/x-www-form-urlencoded
   
   action=rename&id=1&eventName=' UNION SELECT password FROM Users WHERE Username='admin' --

   This payload is safely stored in the database via a parameterized query.
3. Trigger second-order injection: Send a GET request to the nearevents entity endpoint, specifying sort_field=Name to cause the stored payload to be concatenated into the SQL query:

   GET /ajax/status.php?entity=nearevents&id=1&sort_field=Name&sort_asc=1 HTTP/1.1

4. SQL query execution: The server fetches the event record (SELECT * FROM Events WHERE Id=1), retrieves the malicious Name value, and builds a vulnerable query:

   SELECT E.Id, E.StartDateTime FROM Events AS E ... WHERE E.Id != 1 AND E.StartDateTime <= '' UNION SELECT password FROM Users WHERE Username='admin' --'

5. Exfiltrate data: The UNION query returns the admin password hash (or other targeted data) in the HTTP response.
6. Alternative vector: Repeat steps 2–5 using the Cause field via action=edit&id=1&newEvent[Cause]=<payload> and sort_field=Cause (GitHub Advisory).

• Network: Unusual POST requests to /ajax/event.php with eventName or newEvent[Cause] parameters containing SQL keywords (e.g., UNION, SELECT, --, single quotes); GET requests to /ajax/status.php with entity=nearevents and sort_field=Name or sort_field=Cause parameters from unexpected users or IPs.
• Logs: Web server access logs showing repeated or anomalous requests to /ajax/event.php (rename/edit actions) followed by requests to /ajax/status.php?entity=nearevents; PHP or database error logs indicating SQL syntax errors or unexpected query structures in getNearEvents().
• Database: Event records in the Events table with Name or Cause fields containing SQL syntax fragments (e.g., UNION SELECT, --, single quotes); unexpected queries in the database query log targeting the Users table from the ZoneMinder application user.
• Application: Unexpected changes to event names or cause fields that contain SQL-like strings; anomalous API responses from the nearevents endpoint containing data inconsistent with event metadata (GitHub Advisory).

ZoneMinder has released patched versions: 1.36.38 and 1.38.1, both of which fix the second-order SQL injection by replacing string concatenation with parameterized query placeholders in both SQL queries within getNearEvents(). Users should upgrade immediately to one of these versions (ZoneMinder 1.36.38 Release, ZoneMinder 1.38.1 Release). As interim mitigations: restrict Events edit and view permissions to only trusted users; implement WAF rules to detect SQL injection patterns in requests to status.php and event.php; apply the principle of least privilege to the database account used by ZoneMinder; and monitor database query logs for anomalous patterns (Feedly).

The vulnerability was covered by The Hacker Wire shortly after disclosure, with a dedicated article on the second-order SQLi in getNearEvents() (The Hacker Wire). Social media discussion was noted on Mastodon and Bluesky via The Hacker Wire's accounts. The infinitsec.net security blog also published a technical write-up (infinitsec). Community reaction has been moderate, consistent with a high-severity but authentication-required vulnerability in a niche open-source project.