mirror of
https://github.com/ZoneMinder/zoneminder.git
synced 2026-06-23 04:59:37 -04:00
97f2fee109
The tablename field of a filter term was copied verbatim into SQL by sql_attr(), while attr, op, val and collate were all sanitized. An authenticated user with Events View permission could inject SQL via the filter[Query][terms][N][tablename] request parameter, enabling blind read access to the whole database (password hashes, camera credentials). Restrict tablename to the table aliases actually used by the filter queries (E, M, S, F, T, ET, Snapshots); reject anything else, log it, and fall back to 'E'. Refs GHSA-q2w3-h644-f8xq Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>