This page tracks the Debian fix status. The vulnerability itself is described on the main CVE page. View CVE-2016-10204 →

DEBIAN-CVE-2016-10204

SQL injection vulnerability in Zoneminder 1.30 and earlier allows remote attackers to execute arbitrary SQL commands via the limit parameter in a log...

Original description

The description as published by the source.

SQL injection vulnerability in Zoneminder 1.30 and earlier allows remote attackers to execute arbitrary SQL commands via the limit parameter in a log query request to index.php.

Source: OSV.dev (Open Source Vulnerabilities) OSV

Affected packages

Debian:12 zoneminder

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.30.4+dfsg-1"}]}]

Debian:13 zoneminder

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.30.4+dfsg-1"}]}]

Debian:14 zoneminder

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.30.4+dfsg-1"}]}]

References

advisory security-tracker.debian.org