CVE-2024-45174 identifies a SQL injection vulnerability in the za-internet C-MOR Video Surveillance software, specifically versions 5.2401 and 6.00PL01. The vulnerability stems from improper sanitization and validation of user-supplied input within various functionalities of the C-MOR web interface. This flaw allows an authenticated attacker to inject arbitrary SQL commands into the MySQL database backend. The vulnerability is classified under CWE-89 (Improper Neutralization of Special Elements used in an SQL Command). The CVSS v3.1 score is 8.1, indicating high severity, with an attack vector of network (remote), low attack complexity, requiring privileges (authenticated user), no user interaction, and impacting confidentiality and integrity but not availability. Exploiting this vulnerability could allow attackers to read sensitive data, modify or delete database records, and potentially escalate privileges within the application context. Although no public exploits are currently known, the presence of this vulnerability in surveillance software that may be deployed in sensitive environments raises significant security concerns. The lack of available patches at the time of disclosure necessitates immediate mitigation efforts by affected organizations.

The primary impact of CVE-2024-45174 is unauthorized access and manipulation of sensitive data stored within the C-MOR Video Surveillance system's MySQL database. This could lead to exposure of surveillance footage, user credentials, configuration data, or other confidential information. Integrity of the database can be compromised, allowing attackers to alter logs, disable alarms, or manipulate system settings, potentially undermining the security monitoring capabilities. Although availability is not directly affected, the loss of data integrity and confidentiality can have severe operational and reputational consequences. Organizations relying on C-MOR for critical infrastructure monitoring, law enforcement, or corporate security may face increased risk of espionage, sabotage, or regulatory non-compliance. The requirement for authentication limits exploitation to insiders or compromised accounts, but the low complexity and network accessibility increase the threat surface. The absence of known exploits currently provides a window for remediation before widespread attacks emerge.

1. Immediately restrict access to the C-MOR web interface to trusted networks and users only, employing network segmentation and firewall rules. 2. Enforce strong authentication mechanisms and monitor for suspicious login activity to reduce risk from compromised credentials. 3. Implement web application firewalls (WAFs) with SQL injection detection and prevention rules tailored to the C-MOR interface. 4. Conduct thorough input validation and sanitization on all user-supplied data within the application, ideally applying parameterized queries or prepared statements to eliminate injection vectors. 5. Regularly audit database queries and logs for anomalous activity indicative of injection attempts. 6. Engage with the vendor for official patches or updates; if unavailable, consider temporary compensating controls such as disabling vulnerable functionalities or isolating the system. 7. Educate administrators and users about the risks of SQL injection and the importance of credential security. 8. Maintain up-to-date backups of surveillance data and configurations to enable recovery in case of data tampering.