ZoneMinder 1.24.3 - Remote File Inclusion

ZoneMinder 1.24.3 - Remote File Inclusion Exploit Title: Zoneminder 1.24.3 Remote File Inclusion Vulnerability Date: 2011-07-22 Author: Iye iyedotcba-at-gmaildotcom Software Link: http://www.zoneminder.com/ Version: 1.24.3 Tested. 1.24.4 probably too, not tested Tested on: Ubuntu 10.04 You must b...

ZoneMinder 1.24.3 - Remote File Inclusion

Exploit Title: Zoneminder 1.24.3 Remote File Inclusion Vulnerability Date: 2011-07-22 Author: Iye iyedotcba-at-gmaildotcom Software Link: http://www.zoneminder.com/ Version: 1.24.3 Tested. 1.24.4 probably too, not tested Tested on: Ubuntu 10.04 You must be authenticated as a user in the Web App t...

Zoneminder 1.24.3 Remote File Inclusion Vulnerability

Exploit for php platform in category web applications Exploit Title: Zoneminder 1.24.3 Remote File Inclusion Vulnerability Author: Iye iyedotcba-at-gmaildotcom Software Link: http://www.zoneminder.com/ Version: 1.24.3 Tested. 1.24.4 probably too, not tested Tested on: Ubuntu 10.04 You must be...

Default credentials

ZoneMinder 1.23.3 on Gentoo Linux uses 0644 permissions for /etc/zm.conf, which allows local users to obtain the database username and password by reading this file...

CVE-2008-6755

ZoneMinder 1.23.3 on Fedora 10 sets the ownership of /etc/zm.conf to the apache user account, and sets the permissions to 0600, which makes it easier for remote attackers to modify this file by accessing it through a 1 PHP or 2 CGI script...

CVE-2008-6756

ZoneMinder 1.23.3 on Gentoo Linux uses 0644 permissions for /etc/zm.conf, which allows local users to obtain the database username and password by reading this file...

DEBIAN-CVE-2008-6756

ZoneMinder 1.23.3 on Gentoo Linux uses 0644 permissions for /etc/zm.conf, which allows local users to obtain the database username and password by reading this file...

CVE-2008-6755

ZoneMinder 1.23.3 on Fedora 10 sets the ownership of /etc/zm.conf to the apache user account, and sets the permissions to 0600, which makes it easier for remote attackers to modify this file by accessing it through a 1 PHP or 2 CGI script...

Code injection

ZoneMinder 1.23.3 on Fedora 10 sets the ownership of /etc/zm.conf to the apache user account, and sets the permissions to 0600, which makes it easier for remote attackers to modify this file by accessing it through a 1 PHP or 2 CGI script...

DEBIAN-CVE-2008-6755

ZoneMinder 1.23.3 on Fedora 10 sets the ownership of /etc/zm.conf to the apache user account, and sets the permissions to 0600, which makes it easier for remote attackers to modify this file by accessing it through a 1 PHP or 2 CGI script...

CVE-2008-6755

ZoneMinder 1.23.3 on Fedora 10 sets the ownership of /etc/zm.conf to the apache user account, and sets the permissions to 0600, which makes it easier for remote attackers to modify this file by accessing it through a 1 PHP or 2 CGI script...

CVE-2008-6756

ZoneMinder 1.23.3 on Gentoo Linux uses 0644 permissions for /etc/zm.conf, which allows local users to obtain the database username and password by reading this file...

CVE-2008-6755

ZoneMinder 1.23.3 on Fedora 10 sets the ownership of /etc/zm.conf to the apache user account, and sets the permissions to 0600, which makes it easier for remote attackers to modify this file by accessing it through a 1 PHP or 2 CGI script...

CVE-2008-6755

ZoneMinder 1.23.3 on Fedora 10 sets the ownership of /etc/zm.conf to the apache user account, and sets the permissions to 0600, which makes it easier for remote attackers to modify this file by accessing it through a 1 PHP or 2 CGI script...

CVE-2008-6756

ZoneMinder 1.23.3 on Gentoo Linux uses 0644 permissions for /etc/zm.conf, which allows local users to obtain the database username and password by reading this file...

CVE-2008-6756

ZoneMinder 1.23.3 on Gentoo Linux uses 0644 permissions for /etc/zm.conf, which allows local users to obtain the database username and password by reading this file...

CVE-2008-6756

CVE-2008-6756 – Normal mode : ZoneMinder 1.23.3 on Gentoo Linux stores /etc/zm.conf with 0644 permissions, allowing any local user to read the file and exfiltrate the database username and password. The impact is a local confidentiality exposure of DB credentials. No remediation details are provi...

CVE-2008-6755

ZoneMinder 1.23.3 on Fedora 10 leaves /etc/zm.conf owned by the apache user and 0600-permissioned. This weakens protection of the configuration file and allows remote attackers to modify it via a web-accessible PHP or CGI script. The described vulnerability is limited to file ownership/permission...

CVE-2008-6755: Undefined Security Weakness

ZoneMinder 1.23.3 on Fedora 10 sets the ownership of /etc/zm.conf to the apache user account, and sets the permissions to 0600, which makes it easier for remote attackers to modify this file by accessing it through a 1 PHP or 2 CGI script...

CVE-2008-6756: Undefined Security Weakness

ZoneMinder 1.23.3 on Gentoo Linux uses 0644 permissions for /etc/zm.conf, which allows local users to obtain the database username and password by reading this file...