CVE-2024-45178

An issue was discovered in za-internet C-MOR Video Surveillance 5.2401. Due to improper user input validation, it is possible to download arbitrary files from the C-MOR system via a path traversal attack. It was found out that different functionalities are vulnerable to path traversal attacks, due to insufficient user input validation. For instance, the download functionality for backups provided by the script download-bkf.pml is vulnerable to a path traversal attack via the parameter bkf. This enables an authenticated user to download arbitrary files as Linux user www-data from the C-MOR system. Another path traversal attack is in the script show-movies.pml, which can be exploited via the parameter cam.

• CWE-22

• https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2024-025.txtExploit, Vendor Advisory
• https://www.syss.de/pentest-blog/mehrere-sicherheitsschwachstellen-in-videoueberwachungssoftware-c-mor-syss-2024-020-bis-030Vendor Advisory
• http://seclists.org/fulldisclosure/2024/Sep/18Exploit, Mailing List, Third Party Advisory

Published

Sep 5, 2024

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-45172An issue was discovered in za-internet C-MOR Video Surveilla…6.8
• CVE-2024-45173An issue was discovered in za-internet C-MOR Video Surveilla…8.8
• CVE-2024-45174An issue was discovered in za-internet C-MOR Video Surveilla…8.1
• CVE-2024-45175An issue was discovered in za-internet C-MOR Video Surveilla…8.8
• CVE-2024-45176An issue was discovered in za-internet C-MOR Video Surveilla…6.1
• CVE-2024-45177An issue was discovered in za-internet C-MOR Video Surveilla…5.4
• CVE-2024-45179An issue was discovered in za-internet C-MOR Video Surveilla…7.2
• CVE-2024-4518A vulnerability was found in Campcodes Complete Web-Based Sc…6.1
• CVE-2024-45180SquaredUp DS for SCOM 6.2.1.11104 allows XSS.5.4
• CVE-2024-45181An issue was discovered in WibuKey64.sys in WIBU-SYSTEMS Wib…7.8
• CVE-2024-45182An issue was discovered in WibuKey64.sys in WIBU-SYSTEMS Wib…5.5
• CVE-2024-45183An issue was discovered in Samsung Mobile Processor Exynos 2…6.5