Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Self - Stored Cross Site Scripting(XSS) - log.php #2453

Closed
Loginsoft-Research opened this issue Jan 24, 2019 · 0 comments
Closed

Self - Stored Cross Site Scripting(XSS) - log.php #2453

Loginsoft-Research opened this issue Jan 24, 2019 · 0 comments

Comments

@Loginsoft-Research
Copy link

Describe Your Environment

  • ZoneMinder v1.33.1
  • Installed from - ppa:iconnor/zoneminder-master

Describe the bug
The view log, insecurely prints the Log Message value on the webpage without applying any proper filtration, leading to XSS.

Example - Attacker can entice the victim visit an non-existing view (using XSS payload instead of a valid view), the non-existing view will be reflected back in the logs, thereby triggering the XSS
payload.

To Reproduce
Affected URL :
http://localhost/zm/index.php?view=logs

Payload used - "><img src=x onerror=prompt('1');>

logs

Expected behavior

  • Proper escaping of special characters.

Debug Logs


None

connortechnology pushed a commit that referenced this issue Jun 4, 2019
…rd formatting, etc. We use an html escaping function to prevent XSS
connortechnology pushed a commit to connortechnology/ZoneMinder that referenced this issue Jun 4, 2019
… td's. Weird formatting, etc. We use an html escaping function to prevent XSS
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

No branches or pull requests

2 participants