CVE-2016-10204

CVE-2016-10206 is a CSRF vulnerability in Zoneminder 1.30 and earlier that allows remote attackers to hijack user authentication for requests that change passwords and possibly other unspecified impacts.

Session fixation vulnerability in Zoneminder 1.30 and earlier allows remote attackers to hijack web sessions via the ZMSESSID cookie.

ZoneMinder versions 1.30 and 1.29 are vulnerable to CSRF attacks, allowing a remote attacker to make changes to the web application as the currently logged-in user. The attacker can silently create a new admin user, enabling further attacks.

ZoneMinder versions prior to 1.36.39, 1.38.4, and 1.39.11 allow an authenticated low-privileged user with coarse Events=View and/or Snapshots=View permissions to directly fetch media for events belonging to monitors they are not allowed to access. The normal UI hides the restricted monitor, but direct event media views accept an arbitrary eid and stream media without enforcing event/monitor-level ACL.

An authenticated OS command injection vulnerability exists in ZoneMinder's event export functionality. The exportFile HTTP request parameter is passed unsanitized into a shell command executed via PHP's exec(), allowing any authenticated user with View Events permission to execute arbitrary operating system commands on the server.

A remote code execution vulnerability in ZoneMinder 1.39.17 allows any authenticated user to execute OS commands by exploiting a broken permission check in the Filter class. canEdit() and canDelete() call nonexistent methods, causing PHP __call() to return truthy and bypass the check.

A Remote Code Execution (RCE) vulnerability in ZoneMinder through version 1.36.33 allows an attacker to create a new .php log file in the language folder. By executing a crafted payload, the attacker can escalate privileges and execute arbitrary commands on the remote system.