ZoneMinder Multiple Vulnerabilities
ZoneMinder Multiple Vulnerabilities
by Filip Palian <filip (dot) palian (at) pjwstk (dot) edu (dot) pl>
Software affected: ZoneMinder <= 1.23.3
Severity: Critical
Description (from the vendor site):
ZoneMinder is an integrated set of applications which provide a complete
surveillance solution allowing capture, analysis, recording and monitoring of
any CCTV or security cameras attached to a Linux based machine.
Overview:
ZoneMinder is prone to Command Injection, SQL Injcetion and XSS. All attacks
are possible because of lack of user input sanitizing.
I. Command Injection
In the "zm_html_view_events.php" function executeFilter() doesn't validate user
input.
In the "zm_html_view_state.php" parameter "run_state" is not validated.
II. SQL Injcetion
In the "zm_html_view_event.php" array "filter" is not validated.
III .XSS
In the "zm_html_view_*.php" multiple XSS exists.
Status:
At the moment no fixes were provided by the vendor. As a workaround restricted
access to authenticated users only and granting the lowest privileges is
suggested.
Disclousre timeline:
18 VI 2008 Vulerability sent to the vendor.
18 VI 2008 Initial vendor response.
26 VIII 2008 Security bulletin released.
Link:
http://www.zoneminder.com/
Best regards,
Filip Palian.