CVE-2024-45179 Command injection in n/a
Authenticated attackers can execute arbitrary OS commands via input validation flaws in the web interface, potentially escalating privileges to root.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2024-45179?
CVE-2024-45179 is a high-severity command injection vulnerability in n/a, published on 9 Oct 2024. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
An issue was discovered in za-internet C-MOR Video Surveillance 5.2401 and 6.00PL01. Due to insufficient input validation, the C-MOR web interface is vulnerable to OS command injection attacks. It was found out that different functionality is vulnerable to OS command injection attacks, for example for generating new X.509 certificates, or setting the time zone. These OS command injection vulnerabilities in the script generatesslreq.pml can be exploited as a low-privileged authenticated user to execute commands in the context of the Linux user www-data via shell metacharacters in HTTP POST data (e.g., the city parameter). The OS command injection vulnerability in the script settimezone.pml or setdatetime.pml (e.g., via the year parameter) requires an administrative user for the C-MOR web interface. By also exploiting a privilege-escalation vulnerability, it is possible to execute commands on the C-MOR system with root privileges.
Weakness: CWE-1289
Which versions are affected by CVE-2024-45179?
It affects 1 product.
Products include C-Mor C-Mor Video Surveillance.
How do I fix CVE-2024-45179?
No fix has been published for CVE-2024-45179 yet. Limit exposure of the affected software until one is available.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2024-45179 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-45179 exists.
Other vulnerabilities in n/a
Sources
Also known as GHSA-2v34-3hgh-5vvx.