An issue was discovered in za-internet C-MOR Video Surveillance 5.2401 and 6.00PL01. Due to improper validation of user-supplied data, different functionalities of the C-MOR web interface are vulnerable to SQL injection attacks. This kind of attack allows an authenticated user to execute arbitrary SQL commands in the context of the corresponding MySQL database.
References
| Link | Resource |
|---|---|
| https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2024-023.txt | Exploit Vendor Advisory |
| https://www.syss.de/pentest-blog/mehrere-sicherheitsschwachstellen-in-videoueberwachungssoftware-c-mor-syss-2024-020-bis-030 | Vendor Advisory |
| http://seclists.org/fulldisclosure/2024/Sep/11 | Exploit Mailing List Third Party Advisory |
Configurations
Configuration 1 (hide)
|
History
04 Sep 2025, 16:29
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:a:c-mor:c-mor_video_surveillance:5.2401:*:*:*:*:*:*:* cpe:2.3:a:c-mor:c-mor_video_surveillance:6.00:patch_level_01:*:*:*:*:*:* |
|
| First Time |
C-mor
C-mor c-mor Video Surveillance |
|
| References | () https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2024-023.txt - Exploit, Vendor Advisory | |
| References | () https://www.syss.de/pentest-blog/mehrere-sicherheitsschwachstellen-in-videoueberwachungssoftware-c-mor-syss-2024-020-bis-030 - Vendor Advisory | |
| References | () http://seclists.org/fulldisclosure/2024/Sep/11 - Exploit, Mailing List, Third Party Advisory |
Information
Published : 2024-09-04 17:15
Updated : 2025-09-04 16:29
NVD link : CVE-2024-45174
Mitre link : CVE-2024-45174
CVE.ORG link : CVE-2024-45174
JSON object : View
Products Affected
c-mor
- c-mor_video_surveillance
CWE
CWE-89
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')