CVE-2023-26039

CVE-2023-26039 描述 ZoneMinder 是一款免费、开源的闭路电视软件应用，适用于 Linux，支持 IP、USB 和模拟摄像头。版本低于 1.36.33 和 1.37.33 的 ZoneMinder 包含一个通过 /web/api/app/Controller/HostController.php 中的 daemonControl 函数触发的操作系统命令注入漏洞。任何经过身份验证的用户都可以构造一个 API 命令，以 Web 用户的身份执行任意 shell 命令。该问题已在 1.36.33 和 1.37.33 版本中得到修复。 安装 git clone...

CVE-2023-26039

ZoneMinder is a free, open source Closed-circuit television software application for Linux which supports IP, USB and Analog cameras. Versions prior to 1.36.33 and 1.37.33 contain an OS Command Injection via daemonControl in /web/api/app/Controller/HostController.php. Any authenticated user can...

CVE-2023-26039 ZoneMinder vulnerable to OS Command injection in daemonControl() API

ZoneMinder is a free, open source Closed-circuit television software application for Linux which supports IP, USB and Analog cameras. Versions prior to 1.36.33 and 1.37.33 contain an OS Command Injection via daemonControl in /web/api/app/Controller/HostController.php. Any authenticated user can...

CVE-2023-26039: Improper Neutralization of Special Elements used in an OS Command

ZoneMinder is a free, open source Closed-circuit television software application for Linux which supports IP, USB and Analog cameras. Versions prior to 1.36.33 and 1.37.33 contain an OS Command Injection via daemonControl in /web/api/app/Controller/HostController.php. Any authenticated user can...