Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Stored Self-Cross Site Scripting (XSS) - controlcaps.php #2445

Closed
Loginsoft-Research opened this issue Jan 24, 2019 · 0 comments
Closed

Stored Self-Cross Site Scripting (XSS) - controlcaps.php #2445

Loginsoft-Research opened this issue Jan 24, 2019 · 0 comments

Comments

@Loginsoft-Research
Copy link

Loginsoft-Research commented Jan 24, 2019

Describe Your Environment

  • ZoneMinder v1.33.1
  • Installed from - ppa:iconnor/zoneminder-master

Describe the bug
The view controlcaps, displays the Protocol field record with no proper filtration, leading to Self - Stored XSS.

To Reproduce
Affected URL :
http://localhost/zm/index.php?view=controlcaps

Payload used - "><img src=x onerror=prompt('1');>

control 1

Expected behavior

  • Proper escaping of special characters.

Debug Logs


None

@Loginsoft-Research Loginsoft-Research changed the title POST (self) - Reflected Cross Site Scripting (XSS) - controlcap.php Stored Self-Cross Site Scripting (XSS) - controlcaps.php Jan 24, 2019
mnoorenberghe added a commit to mnoorenberghe/ZoneMinder that referenced this issue Jan 25, 2019
mnoorenberghe added a commit to mnoorenberghe/ZoneMinder that referenced this issue Jan 25, 2019
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant