Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Self - Stored Cross Site Scripting(XSS) - _monitor_filters.php #2457

Closed
Loginsoft-Research opened this issue Jan 24, 2019 · 0 comments
Closed

Comments

@Loginsoft-Research
Copy link

Describe Your Environment

  • ZoneMinder v1.33.1
  • Installed from - ppa:iconnor/zoneminder-master

Describe the bug
Multiple views include the view _monitor_filters.php, being the file where the vulnerable code exists. The view _monitor_filters contains a filter form, where it takes in input from the user & saves it into the session, in order to preserve & retrieve it later (insecurely). The value of MonitorName & Source parameter are being displayed without any output filtration being applied.

To Reproduce

Multiple Views (cycle.php example )

Affected URL :
http://localhost/zm/index.php?view=cycle&filtering=&MonitorName="><img src=x onerror-prompt('1');>&Function[]=Modect&Status[]=Unknown&Status[]=w&Source="><img src=x onerror-prompt('1');>

Payload used - "><img src=x onerror-prompt('1');>

  • Navigate to the Affected URL, Payload would be triggered.

cycle

Expected behavior

  • Proper escaping of special characters.

Debug Logs


None

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

No branches or pull requests

2 participants