CyberRota Analysis
AI-GeneratedAn authenticated OS command injection vulnerability in ZoneMinder's event export functionality allows any user with View Events permission to execute arbitrary commands on the server through unsanitized input in the exportFile HTTP request parameter. This high-severity flaw (CVSS 8.8) poses a significant risk to system integrity and confidentiality. Organizations using ZoneMinder should prioritize patching this vulnerability to mitigate potential exploitation.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
An authenticated OS command injection vulnerability exists in ZoneMinder's event export functionality. The exportFile HTTP request parameter is passed unsanitized into a shell command executed via PHP's exec(), allowing any authenticated user with View Events permission to execute arbitrary operating system commands on the server.