Shinobi before commit 5a76c74f contains a hardcoded connection key in the child node service that allows unauthenticated attackers to execute arbitrary database queries. Attackers reaching the child node port can present the hardcoded key during WebSocket handshake, then dispatch SQL queries through the onWebSocketDataFromChildNode handler to read and modify user records and camera configuration.

Shinobi CCTV software prior to commit 5a76c74f contains a hardcoded connection key in its child node service. Unauthenticated attackers who can reach the child node port can use this hardcoded key during a WebSocket handshake to gain unauthorized access. Once authenticated via the hardcoded key, attackers can dispatch arbitrary SQL queries through the onWebSocketDataFromChildNode handler. This allows reading and modifying sensitive user records and camera configuration data. The vulnerability exists in the libs/childNode/utils.js file. A fix was introduced in commit 5a76c74f and merge request 554. The issue is classified as high severity due to unauthenticated access and full database query execution capability. No user interaction is required to exploit this vulnerability.