Chris Beiter

An issue was discovered where sensitive information, such as login credentials of cameras, is stored in cleartext. This allows an attacker with filesystem access, potentially gained through exploiting a path traversal attack, to access the login data of all configured cameras or the configured FTP server.

An issue was discovered due to improper input validation, making the C-MOR web interface vulnerable to reflected cross-site scripting (XSS) attacks. Different functions are prone to reflected cross-site scripting attacks due to insufficient user input validation.

An issue was discovered due to improper privilege management concerning sudo privileges, making C-MOR vulnerable to a privilege escalation attack. The Linux user www-data running the C-MOR web interface can execute some OS commands as root via Sudo without having to enter the root password. These commands include `cp`, `chown`, and `chmod`, which enable an attacker to modify the system's sudoers file in order to execute all commands with root privileges. Thus, it is possible to escalate the limited privileges of the user www-data to root privileges.

An issue was discovered due to improper user input validation, making it possible to download arbitrary files from the system via a path traversal attack. Different functionalities are vulnerable to path traversal attacks, including the download functionality for backups provided by the script `download-bkf.pml` via the parameter `bkf`, and the script `show-movies.pml` via the parameter `cam`. This enables an authenticated user to download arbitrary files as Linux user `www-data` from the system.

An issue was discovered due to improper user input validation, allowing the upload of dangerous files, such as PHP code, to the system. The upload functionality for backup files permits an authenticated user to upload arbitrary files if the filename contains a .cbkf string. Uploaded files are stored in the "/srv/www/backups" directory and can be accessed via the URL https://<HOST>/backup/upload <FILENAME>. Low-privileged authenticated users can also exploit this file upload functionality due to broken access control.

An issue was discovered due to improper or missing access control, allowing low privileged users to use administrative functions of the C-MOR web interface. Although different functions are only available to administrative users through the web application user interface, access to those functions is not checked on the server side. This allows low privileged users to send corresponding HTTP requests to the web server and use administrative functionality, such as downloading backup files or changing configuration settings.

An issue was discovered in the C-MOR web interface, which is vulnerable to cross-site request forgery (CSRF) attacks due to missing protection mechanisms. The C-MOR web interface offers no protection against CSRF attacks.

An issue was discovered due to improper validation of user-supplied data, making different functionalities of the C-MOR web interface vulnerable to SQL injection attacks. This allows an authenticated user to execute arbitrary SQL commands in the context of the corresponding MySQL database.

The issue is related to improper input validation in the C-MOR web interface, making it vulnerable to persistent cross-site scripting (XSS) attacks. This allows an attacker to inject malicious scripts remotely. The camera configuration is specifically vulnerable due to insufficient user input validation.

An issue was discovered due to insufficient input validation, making the C-MOR web interface vulnerable to OS command injection attacks. The vulnerability can be exploited by a low-privileged authenticated user to execute commands in the context of the Linux user www-data via shell metacharacters in HTTP POST data, for example, the `city` parameter. Additionally, an administrative user can exploit the OS command injection vulnerability in the script settimezone.pml or setdatetime.pml, for instance, via the `year` parameter. By also exploiting a privilege-escalation vulnerability, it is possible to execute commands on the C-MOR system with root privileges.