Stored Self-Cross Site Scripting (XSS) - zones.php

[Loginsoft-Research]

Describe Your Environment

• ZoneMinder v1.33.1
• Installed from - ppa:iconnor/zoneminder-master

Describe the bug
In the view zone, an user can add/view/delete zones. While adding a zone, there exists no input filtration, allowing an attacker to inject unintended values. Later while displaying the zone names on the webpage,there exists no output filtration, leading to Self - Stored based XSS.

To Reproduce
Affected URL :
http://localhost/zm/index.php?view=zones&action=zoneImage&mid=1

Payload used - "><img src=x onerror-prompt('1');>

• Navigate to the Affected URL
• Click on Add a new zone (pop-up appears)
• Add the XSS payload into the NAME field & select any of option from the Type dropdown field & click on save.
• Navigate back to the Affected URL, payload would be triggered.

Expected behavior

• Proper escaping of special characters.

Debug Logs

None