CVE-2023-26035
HIGH NUCLEIZoneMinder < 1.36.33 - Unauthenticated Remote Code Execution via Snapshot Action
Title source: llmExploitation Summary
EIP tracks 7 public exploits for CVE-2023-26035.
PoCs published by rvzsec, rvizx, heapbytes, including Metasploit module exploits/unix/webapp/zoneminder_snapshots.
A Nuclei detection template is also available.
AI-analyzed exploit summary This repository contains a functional exploit for CVE-2023-26035, an unauthenticated RCE vulnerability in ZoneMinder. The exploit fetches a CSRF token and injects a command into the 'monitor_ids[0][Id]' parameter to achieve remote code execution.
Description
ZoneMinder is a free, open source Closed-circuit television software application for Linux which supports IP, USB and Analog cameras. Versions prior to 1.36.33 and 1.37.33 are vulnerable to Unauthenticated Remote Code Execution via Missing Authorization. There are no permissions check on the snapshot action, which expects an id to fetch an existing monitor but can be passed an object to create a new one instead. TriggerOn ends up calling shell_exec using the supplied Id. This issue is fixed in This issue is fixed in versions 1.36.33 and 1.37.33.
Exploits (7)
This repository contains a functional exploit for CVE-2023-26035, an unauthenticated RCE vulnerability in ZoneMinder. The exploit fetches a CSRF token and injects a command into the 'monitor_ids[0][Id]' parameter to achieve remote code execution.
This repository contains a functional exploit for CVE-2023-26035, an unauthenticated RCE vulnerability in ZoneMinder. The exploit fetches a CSRF token and injects a reverse shell payload via the snapshot action, demonstrating the vulnerability effectively.
This repository contains a functional Python exploit for CVE-2023-26035, a Remote Code Execution (RCE) vulnerability in ZoneMinder versions prior to 1.36.33 and 1.37.33. The exploit leverages CSRF token extraction and command injection via the 'monitor_ids[0][Id]' parameter.
This repository contains a functional exploit for CVE-2023-26035, an unauthenticated remote code execution vulnerability in ZoneMinder. The exploit fetches a CSRF token and injects a command into the 'monitor_ids[0][Id]' parameter during snapshot creation.
This repository contains a functional Python exploit for CVE-2023-26035, an unauthenticated remote code execution (RCE) vulnerability in ZoneMinder. The exploit leverages a command injection flaw in the snapshot creation functionality, allowing arbitrary command execution via crafted HTTP requests.
This repository contains a functional Python exploit for CVE-2023-26035, an unauthenticated RCE vulnerability in ZoneMinder versions prior to 1.36.33 and 1.37.33. The exploit leverages command injection in the snapshot creation functionality to execute a reverse shell.
This Metasploit module exploits an unauthenticated command injection vulnerability in ZoneMinder by appending commands to the 'create monitor ids[]' action in the snapshot view. It supports both direct command execution and staged payload delivery.
Nuclei Templates (1)
html:"ZM - Login" || http.html:"zm - login"
body="zm - login"
References (2)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N