Информационная безопасность
[RU] switch to English

Дополнительная информация

  Ежедневная сводка уязвимостей безопасности в Web-приложениях (PHP, ASP, JSP, CGI, Perl)

  Multiple Vulnerabilities in AWStats Totals

  Mini-NUKE v2.3 Freehost (tr) Multiple Remote SQL Injection Vulnerabilities

  Crafty Syntax Live Help <= 2.14.6 SQL Injection

  Secunia Research: Calendarix Basic Two SQL Injection Vulnerabilities

From:filip.palian_(at)_pjwstk.edu.pl <filip.palian_(at)_pjwstk.edu.pl>
Date:26 августа 2008 г.
Subject:ZoneMinder Multiple Vulnerabilities

ZoneMinder Multiple Vulnerabilities

by Filip Palian <filip (dot) palian (at) pjwstk (dot) edu (dot) pl>

Software affected: ZoneMinder <= 1.23.3

Severity: Critical

Description (from the vendor site):
ZoneMinder is an integrated set of applications which provide a complete surveillance solution
allowing capture, analysis, recording and monitoring of any CCTV or security cameras attached to a
Linux based machine.

ZoneMinder is prone to Command Injection, SQL Injcetion and XSS. All attacks are possible because of
lack of user input sanitizing.

I. Command Injection
In the "zm_html_view_events.php" function executeFilter() doesn't validate user input.
In the "zm_html_view_state.php" parameter "run_state" is not validated.

II. SQL Injcetion
In the "zm_html_view_event.php" array "filter" is not validated.

In the "zm_html_view_*.php" multiple XSS exists.

At the moment no fixes were provided by the vendor. As a workaround restricted access to
authenticated users only and granting the lowest privileges is suggested.

Disclousre timeline:
18 VI   2008 Vulerability sent to the vendor.
18 VI   2008 Initial vendor response.
26 VIII 2008 Security bulletin released.


Best regards,
Filip Palian.

О сайте | Условия использования
© SecurityVulns, 3APA3A, Владимир Дубровин
Нижний Новгород