Published: 20/03/2013 Updated: 29/08/2013

CVSS v2 Base Score: 7.5 | Impact Score: 6.4 | Exploitability Score: 10

VMScore: 755

Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P

includes/functions.php in ZoneMinder Video Server 1.24.0, 1.25.0, and previous versions allows remote malicious users to execute arbitrary commands via shell metacharacters in the (1) runState parameter in the packageControl function; or (2) key or (3) command parameter in the setDeviceStatusX10 function.

Vulnerable Product	Search on Vulmon	Subscribe to Product
zoneminder zoneminder 1.24.4
zoneminder zoneminder 1.25.0
zoneminder zoneminder 1.24.0
zoneminder zoneminder 1.24.1
zoneminder zoneminder 1.24.2
zoneminder zoneminder 1.24.3

Debian Bug report logs - #698910 zoneminder: CVE-2013-0232: arbitrary command execution vulnerability Package: src:zoneminder; Maintainer for src:zoneminder is Dmitry Smirnov <onlyjob@debianorg>; Reported by: Salvatore Bonaccorso <carnil@debianorg> Date: Fri, 25 Jan 2013 07:00:02 UTC Severity: grave Tags: patch, se ...

Debian Bug report logs - #700912 zoneminder: CVE-2013-0332: local file inclusion vulnerability Package: zoneminder; Maintainer for zoneminder is Dmitry Smirnov <onlyjob@debianorg>; Source for zoneminder is src:zoneminder (PTS, buildd, popcon) Reported by: Salvatore Bonaccorso <carnil@debianorg> Date: Tue, 19 Feb 20 ...

## # This file is part of the Metasploit Framework and may be subject to # redistribution and commercial restrictions Please see the Metasploit # Framework web site for more information on licensing and terms of use # metasploitcom/framework/ ## require 'msf/core' class Metasploit3 < Msf::Exploit::Remote Rank = ExcellentRanking in ...

NVD-CWE-noinfo http://itsecuritysolutions.org/2013-01-22-ZoneMinder-Video-Server-arbitrary-command-execution-vulnerability/http://www.openwall.com/lists/oss-security/2013/01/28/2 http://www.debian.org/security/2013/dsa-2640 http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=698910 http://www.osvdb.org/89529 http://www.zoneminder.com/forums/viewtopic.php?f=29&t=20771 http://www.exploit-db.com/exploits/24310 https://nvd.nist.gov https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=698910 https://www.exploit-db.com/exploits/24310/

CVE-2013-0232

Vulnerability Summary

Vendor Advisories

Exploits

References

Vulmon Search

About

Products

Connect