PT-2024-31462 · Za Internet · Za-Internet C-Mor Video Surveillance
Chris Beiter
+2
·
Published
2024-09-05
·
Updated
2025-09-04
·
CVE-2024-45178
CVSS v3.1
7.1
High
| Vector | AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N |
Name of the Vulnerable Software and Affected Versions
za-internet C-MOR Video Surveillance version 5.2401
Description
An issue was discovered due to improper user input validation, making it possible to download arbitrary files from the system via a path traversal attack. Different functionalities are vulnerable to path traversal attacks, including the download functionality for backups provided by the script
download-bkf.pml via the parameter bkf, and the script show-movies.pml via the parameter cam. This enables an authenticated user to download arbitrary files as Linux user www-data from the system.Recommendations
For version 5.2401, consider disabling the
download-bkf.pml and show-movies.pml scripts until a patch is available to prevent path traversal attacks. Restrict access to the bkf and cam parameters in the affected scripts to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.Exploit
Path traversal
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Za-Internet C-Mor Video Surveillance