ZoneMinder Snapshots < 1.37.33 - Unauthenticated Remote Code Execution Exploit

import re import requests from bs4 import BeautifulSoup import argparse import base64 Exploit Title: Unauthenticated RCE in ZoneMinder Snapshots Date: 12 December 2023 Discovered by : @Unblvr1 Exploit Author: Ravindu Wickramasinghe @rvizx9 Vendor Homepage: https://zoneminder.com/ Software Link:...

ZoneMinder Snapshots < 1.37.33 - Unauthenticated RCE

import re import requests from bs4 import BeautifulSoup import argparse import base64 Exploit Title: Unauthenticated RCE in ZoneMinder Snapshots Date: 12 December 2023 Discovered by : @Unblvr1 Exploit Author: Ravindu Wickramasinghe @rvizx9 Vendor Homepage: https://zoneminder.com/ Software Link:...

Exploit for Missing Authorization in Zoneminder

Exploit - ZoneMinder CVE-2023-26035 There is a Unauthentica...

Exploit for Missing Authorization in Zoneminder

CVE-2023-26035 ZoneMinder Snapshots - Unauthenticated !image...

Exploit for Missing Authorization in Zoneminder

POC for CVE-2023-26035 Works for ZoneMinder Versions prior...

Exploit for Missing Authorization in Zoneminder

Zoneminder Unauthenticated RCE via Snapshots CVE-2023-26035...

Exploit for Missing Authorization in Zoneminder

CVE-2023-26035 Unauthenticated RCE in ZoneMinder Snapshots - P...

Metasploit Weekly Wrap-Up

Possible Web Service Removal Metasploit has support for running with a local database, or from a remote web service which can be initialized with msfdb init --component webservice. Future versions of Metasploit Framework may remove the msfdb remote webservice. Users that leverage this functionali...

ZoneMinder Snapshots Command Injection Exploit

This Metasploit module exploits an unauthenticated command injection in zoneminder that can be exploited by appending a command to an action of the snapshot view. Versions prior to 1.36.33 and 1.37.33 are affected. This module requires Metasploit: https://metasploit.com/download Current source:...

ZoneMinder Snapshots Command Injection

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'ZoneMinder Snapshots Command Injection', 'Description' = %q This module exploits an unauthenticated command injection in zoneminder that can be...

ZoneMinder Path Traversal

The vulnerability of the ZoneMinder video surveillance software relates to incorrect restrictions on the path name to the restricted access catalog. Exploiting this vulnerability allows a malicious actor to execute arbitrary code by sending a specially created file to the server...

ZoneMinder zmLoadUser() Code Execution

The vulnerability of the zmLoadUser function in the ZoneMinder video surveillance software’s code involves a buffer overflow in the stack. Exploiting this vulnerability could allow an attacker to execute arbitrary code or cause service interruptions...

Zoneminder < v1.37.24 - Log Injection & Stored XSS & CSRF Bypass Exploit

Exploit Title: Zoneminder v1.36.26 - Log Injection - CSRF Bypass - Stored Cross-Site Scripting XSS Exploit Author: Trenches of IT Vendor Homepage: https://github.com/ZoneMinder/zoneminder Version: v1.36.26 Tested on: Linux/Windows CVE: CVE-2022-39285, CVE-2022-39290, CVE-2022-39291 Writeup:...

Zoneminder Log Injection / XSS / Cross Site Request Forgery

Exploit Title: Zoneminder v1.36.26 - Log Injection - CSRF Bypass - Stored Cross-Site Scripting XSS Date: 10/01/2022 Exploit Author: Trenches of IT Vendor Homepage: https://github.com/ZoneMinder/zoneminder Version: v1.36.26 Tested on: Linux/Windows CVE: CVE-2022-39285, CVE-2022-39290, CVE-2022-392...

Zoneminder < v1.37.24 - Log Injection & Stored XSS & CSRF Bypass

Exploit Title: Zoneminder v1.36.26 - Log Injection - CSRF Bypass - Stored Cross-Site Scripting XSS Date: 10/01/2022 Exploit Author: Trenches of IT Vendor Homepage: https://github.com/ZoneMinder/zoneminder Version: v1.36.26 Tested on: Linux/Windows CVE: CVE-2022-39285, CVE-2022-39290, CVE-2022-392...

SQL Injection

zoneminder is vulnerable to SQL Injection attacks. An attacker could use a malicious JWT token to execute SQL queries, as the Username field of the JWT token was trusted. If the HASH key used by ZoneMinder was determined, the attacker could generate a malicious JWT token and use it to execute...

SQL Injection

zoneminder is vulnerable to SQL Injection attacks. The SQL Injection vulnerability is present in the filterQueryterms0attr query string parameter of the /zm/index.php endpoint, allowing unauthorized data access, authentication bypass, and remote code execution...

Authentication Bypass

zoneminder is vulnerable to Authentication Bypass. The vulnerability exists due to the improper permissions check on the snapshot action, which trigger ends up calling shellexec using the supplied Id, allowing an attacker to bypass the authorization mechanism by injecting and executing malicious...

Debian: Security Advisory (DLA-806-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

ZoneMinder shell_exec() Code Execution

The vulnerability of the shellexec function in the software for video surveillance by ZoneMinder is related to deficiencies in authentication procedures. Exploiting this vulnerability could allow a malicious actor to execute arbitrary code remotely...