Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Reflected Cross Site Scripting(XSS) - events.php #2456

Loginsoft-Research opened this issue Jan 24, 2019 · 0 comments


Copy link

commented Jan 24, 2019

Describe Your Environment

  • ZoneMinder v1.33.1
  • Installed from - ppa:iconnor/zoneminder-master

Describe the bug
The view events, insecurely displays the limit parameter value, without applying any proper output filtration leading to XSS. This issue exists because of function sortHeader() in functions.php which insecurely returns the value of limit query string parameter without applying any filtration.

To Reproduce
Affected URL :
http://localhost/zm/index.php?view=events&filter[Query][terms][0][attr]=Archived&filter[Query][terms][0][op]==&filter[Query][terms][0][val]=0&filter[Query][terms][1][cnj]=-3439)OR1=1-&filter[Query][terms][1][attr]=DiskPercent&filter[Query][terms][1][op]=>=&filter[Query][terms][1][val]=95&sort_field=Id&sort_asc=2&limit="><img src=x onerror-prompt('1');>&page=2

Payload used - "><img src=x onerror-prompt('1');>

  • Navigate to the Affected URL, Payload would be triggered.

events 2

Expected behavior

  • Proper escaping of special characters.

Debug Logs


Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
None yet
2 participants
You can’t perform that action at this time.