SySS Advisory: C-MOR Video Surveillance SQL Injection Vulnerability (CVE-2024-45174)

From this webpage screenshot, the following key information about the vulnerability can be obtained: 1. Vulnerability Description: - Product: C-MOR Video Surveillance - Manufacturer: za-internet GmbH - Affected Versions: 5.2401, 6.00PL01 - Tested Versions: 5.2401, 6.00PL01 - Vulnerability Type: SQL Injection (CWE-89) - Risk Level: High - Manufacturer Notification Date: 2024-04-05 - Public Disclosure Date: 2024-09-04 - CVE Reference: CVE-2024-45174 - Authors: Chris Beiter, Frederik Beimgraben, and Matthias Deeg 2. Vulnerability Details: - Analysis of C-MOR’s web interface revealed SQL injection vulnerabilities in various functional modules. - These vulnerabilities allow authenticated users to execute arbitrary SQL commands in the context of the MySQL database. 3. Exploitation: - The SQL injection vulnerabilities can be exploited using the sqlmap tool, targeting the URL parameter “cam”. - Example payload: 4. Remediation: - The described security vulnerability is not fully fixed in the newly released software version 6.00PL01. - No patch is available for this security issue. 5. Disclosure Timeline: - 2024-04-05: Vulnerability reported to the manufacturer. - 2024-04-05: Manufacturer acknowledges receipt of the security advisory. - 2024-04-08: Communication regarding security update and disclosure timeline. - 2024-05-08: Further communication on security update and disclosure timeline; public release of all security advisories. - 2024-05-10: Release of C-MOR software version 6.00PL01, including security updates. - 2024-07-19: Email regarding the release date of C-MOR software version 6.00PL01. - 2024-07-30: Email regarding the release date of C-MOR software version 6.00PL01. - 2024-07-31: Official release of C-MOR software version 6.00PL01. 6. References: - Product Website - SySS Security Advisory - SySS Responsible Disclosure Policy - sqlmap GitHub Repository 7. Disclaimer: - The information in this security advisory is provided “as is” without any warranty. - This advisory may be updated to provide the most accurate information possible. - The latest version of this advisory can be found on the SySS website. 8. Copyright: - Creative Commons — Attribution (by) — Version 3.0 - URL: http://creativecommons.org/licenses/by/3.0/deed.en This information provides a detailed description of the SQL injection vulnerability in the C-MOR Video Surveillance system, including exploitation methods, remediation status, and disclosure timeline.

Goal Reached Thanks to every supporter — we hit 100%!

SySS Advisory: C-MOR Video Surveillance SQL Injection Vulnerability (CVE-2024-45174)