CVE-2013-0232

50Vexday Risk Score

Patch soon. It has a working public exploit.

ssvc Attendepss 48%

from disclosure to weapon0 days

Published on NVDMar 20

1st PoCJan 24

metasploitJan 22

exploitation probability

48%top 1% of all CVEs

observed exploitation

nono source reports it

2 public exploit(s)

includes/functions.php in ZoneMinder Video Server 1.24.0, 1.25.0, and earlier allows remote attackers to execute arbitrary commands via shell metacharacters in the (1) runState parameter in the packageControl function; or (2) key or (3) command parameter in the setDeviceStatusX10 function.

Affected products

n/a · n/a

public PoCs found — 2

cve_referencewww.exploit-db.com/exploits/24310unverified exploitdbwww.exploit-db.com/exploits/24310unverified

⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

References

http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=698910 http://itsecuritysolutions.org/2013-01-22-ZoneMinder-Video-Server-arbitrary-command-execution-vulnerability/http://www.debian.org/security/2013/dsa-2640 http://www.exploit-db.com/exploits/24310 http://www.openwall.com/lists/oss-security/2013/01/28/2 http://www.osvdb.org/89529 http://www.zoneminder.com/forums/viewtopic.php?f=29&t=20771