CVSS: 8.8EPSS: 0%CPEs: 2EXPL: 0CVE-2023-26039 – ZoneMinder vulnerable to OS Command injection in daemonControl() API
https://notcve.org/view.php?id=CVE-2023-26039
ZoneMinder is a free, open source Closed-circuit television software application for Linux which supports IP, USB and Analog cameras. Versions prior to 1.36.33 and 1.37.33 contain an OS Command Injection via daemonControl() in (/web/api/app/Controller/HostController.php). Any authenticated user can construct an api command to execute any shell command as the web user. This issue is patched in versions 1.36.33 and 1.37.33. • https://github.com/ZoneMinder/zoneminder/security/advisories/GHSA-44q8-h2pw-cc9g • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •
CVSS: 6.5EPSS: 0%CPEs: 2EXPL: 1CVE-2023-26038 – ZoneMinder contains Local File Inclusion vulnerability via `web/ajax/modal.php`
https://notcve.org/view.php?id=CVE-2023-26038
ZoneMinder is a free, open source Closed-circuit television software application for Linux which supports IP, USB and Analog cameras. Versions prior to 1.36.33 and 1.37.33 contain a Local File Inclusion (Untrusted Search Path) vulnerability via web/ajax/modal.php, where an arbitrary php file path can be passed in the request and loaded. This issue is patched in versions 1.36.33 and 1.37.33. • https://github.com/ZoneMinder/zoneminder/security/advisories/GHSA-wrx3-r8c4-r24w • CWE-426: Untrusted Search Path •
CVSS: 9.8EPSS: 0%CPEs: 2EXPL: 0CVE-2023-26037 – ZoneMinder contains SQL Injection via report_event_audit
https://notcve.org/view.php?id=CVE-2023-26037
ZoneMinder is a free, open source Closed-circuit television software application for Linux which supports IP, USB and Analog cameras. Versions prior to 1.36.33 and 1.37.33 contain an SQL Injection. The minTime and maxTime request parameters are not properly validated and could be used execute arbitrary SQL. This issue is fixed in versions 1.36.33 and 1.37.33. • https://github.com/ZoneMinder/zoneminder/security/advisories/GHSA-65jp-2hj3-3733 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 9.8EPSS: 0%CPEs: 2EXPL: 1CVE-2023-26036 – ZoneMinder contains Local File Inclusion vulnerability
https://notcve.org/view.php?id=CVE-2023-26036
ZoneMinder is a free, open source Closed-circuit television software application for Linux which supports IP, USB and Analog cameras. Versions prior to 1.36.33 and 1.37.33 contain a Local File Inclusion (Untrusted Search Path) vulnerability via /web/index.php. By controlling $view, any local file ending in .php can be executed. This is supposed to be mitigated by calling detaintPath, however dentaintPath does not properly sandbox the path. This can be exploited by constructing paths like "..././", which get replaced by "../". • https://github.com/ZoneMinder/zoneminder/security/advisories/GHSA-h5m9-6jjc-cgmw • CWE-426: Untrusted Search Path •
CVSS: 9.8EPSS: 96%CPEs: 2EXPL: 3CVE-2023-26035 – ZoneMinder vulnerable to Missing Authorization
https://notcve.org/view.php?id=CVE-2023-26035
ZoneMinder is a free, open source Closed-circuit television software application for Linux which supports IP, USB and Analog cameras. Versions prior to 1.36.33 and 1.37.33 are vulnerable to Unauthenticated Remote Code Execution via Missing Authorization. There are no permissions check on the snapshot action, which expects an id to fetch an existing monitor but can be passed an object to create a new one instead. TriggerOn ends up calling shell_exec using the supplied Id. This issue is fixed in This issue is fixed in versions 1.36.33 and 1.37.33. • https://github.com/rvizx/CVE-2023-26035 https://github.com/heapbytes/CVE-2023-26035 https://github.com/Yuma-Tsushima07/CVE-2023-26035 http://packetstormsecurity.com/files/175675/ZoneMinder-Snapshots-Command-Injection.html https://github.com/ZoneMinder/zoneminder/security/advisories/GHSA-72rg-h4vf-29gr • CWE-862: Missing Authorization •