CVE-2023-31493 Code injection in n/a
Attackers can execute arbitrary code and escalate privileges by creating malicious PHP log files in ZoneMinder.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2023-31493?
CVE-2023-31493 is a medium-severity code injection vulnerability in Zoneminder Zoneminder, published on 15 Oct 2024. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
RCE (Remote Code Execution) exists in ZoneMinder through 1.36.33 as an attacker can create a new .php log file in language folder, while executing a crafted payload and escalate privileges allowing execution of any commands on the remote system.
Weakness: CWE-94
Which versions are affected by CVE-2023-31493?
It affects 1 product.
Products include Zoneminder Zoneminder.
How do I fix CVE-2023-31493?
No fix has been published for CVE-2023-31493 yet. Limit exposure of the affected software until one is available.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2023-31493 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2023-31493 exists.
Other vulnerabilities in Zoneminder Zoneminder
Sources
Also known as DEBIAN-CVE-2023-31493, UBUNTU-CVE-2023-31493.