{"id":"CVE-2013-0232","aliases":["DEBIAN-CVE-2013-0232","DSA-2640-1","EUVD-2013-0266","GHSA-c4jr-gf6w-2x72","UBUNTU-CVE-2013-0232"],"status":"published","title":"includes/functions.php in ZoneMinder Video Server 1.24.0, 1.25.0, and earlier allows remote...","description":"includes/functions.php in ZoneMinder Video Server 1.24.0, 1.25.0, and earlier allows remote attackers to execute arbitrary commands via shell metacharacters in the (1) runState parameter in the packageControl function; or (2) key or (3) command parameter in the setDeviceStatusX10 function.","severity":{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.47895,"percentile":0.98863,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"published":"2013-03-14T00:00:00Z","modified":"2026-09-01T20:03:14Z","exploits":[{"source":"metasploit","id":"exploit/unix/webapp/zoneminder_packagecontrol_exec","title":"ZoneMinder Video Server packageControl Command Execution","type":"exploit","platform":"Unix","date":"2013-01-22","verified":true,"url":"https://www.rapid7.com/db/modules/exploit/unix/webapp/zoneminder_packagecontrol_exec"},{"source":"exploitdb","id":"EDB-24310","title":"ZoneMinder Video Server - packageControl Command Execution (Metasploit)","type":"remote","platform":"unix","date":"2013-01-24","verified":true,"url":"https://www.exploit-db.com/exploits/24310"}],"fixes":[{"ecosystem":"Debian:12","package":"zoneminder","fixed_in":["1.25.0-4"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"zoneminder","fixed_in":["1.25.0-4"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"zoneminder","fixed_in":["1.25.0-4"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"zoneminder","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.25.0-4"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"zoneminder","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.25.0-4"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"zoneminder","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.25.0-4"}]}]},{"source":"osv","ecosystem":"Debian:6.0","package":"zoneminder","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.24.2-8+squeeze1"}]}],"versions":["1.24.2-8"],"bundled":2}],"products":[{"vendor":"zoneminder","product":"zoneminder"}],"references":[{"url":"http://itsecuritysolutions.org/2013-01-22-ZoneMinder-Video-Server-arbitrary-command-execution-vulnerability/","tags":["x_refsource_MISC","x_transferred","Exploit","evidence"]},{"url":"http://www.openwall.com/lists/oss-security/2013/01/28/2","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"http://www.zoneminder.com/forums/viewtopic.php?f=29\u0026t=20771","tags":["x_refsource_MISC","x_transferred","web"]},{"url":"http://www.debian.org/security/2013/dsa-2640","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","advisory"]},{"url":"http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=698910","tags":["x_refsource_MISC","x_transferred","web"]},{"url":"http://www.exploit-db.com/exploits/24310","tags":["exploit","x_refsource_EXPLOIT-DB","x_transferred","web"]},{"url":"http://www.osvdb.org/89529","tags":["vdb-entry","x_refsource_OSVDB","x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2013-0232"},{"url":"http://itsecuritysolutions.org/2013-01-22-ZoneMinder-Video-Server-arbitrary-command-execution-vulnerability"},{"url":"https://github.com/advisories/GHSA-c4jr-gf6w-2x72"},{"url":"https://security-tracker.debian.org/tracker/CVE-2013-0232","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2013-0232","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=904103","tags":["report"]},{"url":"https://github.com/ZoneMinder/ZoneMinder/issues/93","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2013-0232","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2013-0232","description":"includes/functions.php in ZoneMinder Video Server 1.24.0, 1.25.0, and earlier allows remote attackers to execute arbitrary commands via shell metacharacters in the (1) runState parameter in the packageControl function; or (2) key or (3) command parameter in the setDeviceStatusX10 function.","status":"published","published":"2013-03-20T15:00:00Z","modified":"2024-08-06T14:18:09.478Z","updated_at":"2026-11-02T14:34:59.551717Z"}],"euvd":[{"id":"EUVD-2013-0266","description":"includes/functions.php in ZoneMinder Video Server 1.24.0, 1.25.0, and earlier allows remote attackers to execute arbitrary commands via shell metacharacters in the (1) runState parameter in the packageControl function; or (2) key or (3) command parameter in the setDeviceStatusX10 function.","status":"published","published":"2013-03-20T15:00:00Z","modified":"2024-08-06T14:18:09Z","updated_at":"2026-11-03T01:56:46.251982Z"}],"ghsa":[{"id":"GHSA-c4jr-gf6w-2x72","title":"includes/functions.php in ZoneMinder Video Server 1.24.0, 1.25.0, and earlier allows remote...","description":"includes/functions.php in ZoneMinder Video Server 1.24.0, 1.25.0, and earlier allows remote attackers to execute arbitrary commands via shell metacharacters in the (1) runState parameter in the packageControl function; or (2) key or (3) command parameter in the setDeviceStatusX10 function.","status":"published","published":"2022-05-05T02:48:39Z","modified":"2025-04-11T04:09:38Z","updated_at":"2026-11-02T15:01:13.537017Z"}],"nvd":[{"id":"CVE-2013-0232","description":"includes/functions.php in ZoneMinder Video Server 1.24.0, 1.25.0, and earlier allows remote attackers to execute arbitrary commands via shell metacharacters in the (1) runState parameter in the packageControl function; or (2) key or (3) command parameter in the setDeviceStatusX10 function.","status":"published","published":"2013-03-20T15:55:00.91Z","modified":"2026-06-16T23:49:01.123Z","cvss":[{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high","assessor":"primary"}],"updated_at":"2026-11-02T14:02:24.091325Z"}],"osv":[{"id":"CVE-2013-0232","description":"includes/functions.php in ZoneMinder Video Server 1.24.0, 1.25.0, and earlier allows remote attackers to execute arbitrary commands via shell metacharacters in the (1) runState parameter in the packageControl function; or (2) key or (3) command parameter in the setDeviceStatusX10 function.","status":"published","published":"2013-03-20T15:55:00Z","modified":"2026-04-10T03:43:16.552477Z","updated_at":"2026-11-02T15:43:58.802805Z"},{"id":"DEBIAN-CVE-2013-0232","description":"includes/functions.php in ZoneMinder Video Server 1.24.0, 1.25.0, and earlier allows remote attackers to execute arbitrary commands via shell metacharacters in the (1) runState parameter in the packageControl function; or (2) key or (3) command parameter in the setDeviceStatusX10 function.","status":"published","published":"2013-03-20T15:55:00.91Z","modified":"2026-09-01T20:03:14.83006309Z","updated_at":"2026-11-02T15:45:25.218101Z"},{"id":"DSA-2640-1","title":"zoneminder - several issues","status":"published","published":"2013-03-14T00:00:00Z","modified":"2026-03-09T01:19:18.727252Z","updated_at":"2026-11-02T15:46:15.489951Z"},{"id":"UBUNTU-CVE-2013-0232","description":"includes/functions.php in ZoneMinder Video Server 1.24.0, 1.25.0, and earlier allows remote attackers to execute arbitrary commands via shell metacharacters in the (1) runState parameter in the packageControl function; or (2) key or (3) command parameter in the setDeviceStatusX10 function.","status":"withdrawn","published":"2013-03-20T15:55:00Z","modified":"2025-07-16T08:10:40.082507Z","updated_at":"2026-11-02T15:54:06.854805Z"}]}}