Scriptkittens

**Name of the Vulnerable Software and Affected Versions** ZoneMinder (affected versions not specified) **Description** An authenticated OS command injection issue exists in the event export functionality. An authenticated user with View Events permission can execute arbitrary operating system commands on the server because the `exportFile` parameter in the HTTP request is passed unsanitized into a shell command executed via the `exec()` function. Real-world incidents have been observed where attackers exploited this flaw to achieve remote code execution and perform lateral movement to connected infrastructure. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.