CVE-2013-0232 includes/functions.php in ZoneMinder Video Server 1.24.0, 1.25.0, and earlier allows remote attackers to execute arbitrary commands via shell metacharacters in the (1) runState parameter in the packag...
HighCVSS 7.5
EPSS 47.9%
Framework module
Public exploit
- Published
- Updated
- Exploit status
- Public exploit available
Description
includes/functions.php in ZoneMinder Video Server 1.24.0, 1.25.0, and earlier allows remote attackers to execute arbitrary commands via shell metacharacters in the (1) runState parameter in the packageControl function; or (2) key or (3) command parameter in the setDeviceStatusX10 function.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/zoneminder(Debian:12) | < 1.25.0-4 | 1.25.0-4 |
| debian/zoneminder(Debian:13) | < 1.25.0-4 | 1.25.0-4 |
| debian/zoneminder(Debian:14) | < 1.25.0-4 | 1.25.0-4 |
| zoneminder | = 1.24.0 | No fix listed |
| zoneminder | = 1.24.1 | No fix listed |
| zoneminder | = 1.24.2 | No fix listed |
| zoneminder | = 1.24.3 | No fix listed |
| zoneminder | = 1.24.4 | No fix listed |
| zoneminder | = 1.25.0 | No fix listed |
References
- Debian Security Tracker CVE-2013-0232 vendor-advisory
- bugs.debian.org issue-tracking
- bugs.debian.org
- itsecuritysolutions.org exploit
- DSA-2640 vendor-advisory
- 24310 exploit
- [oss-security] 20130128 Re: CVE Request: zoneminder: arbitrary command execution vulnerability mailing-list
- 89529 vdb-entry
- www.zoneminder.com