CVE-2026-51133 in C-MOR Video Surveillance
Summary
by MITRE • 09/15/2026
Cross Site Scripting vulnerability in za-internet GmbH C-MOR Video Surveillance <= V6.0104 allows a remote attacker to execute arbitrary code via the size parameter in ptzpreset.pml component and the showmovies.pml component
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 09/15/2026
The identified security flaw represents a classic Cross-Site Scripting vulnerability within the web-based management interface of za-internet GmbH C-MOR Video Surveillance systems, specifically affecting versions up to V6.0104. This type of vulnerability arises from insufficient input validation and sanitization mechanisms when processing user-supplied data before rendering it in an HTML context. In this specific instance, the flaw is present within two distinct components: ptzpreset.pml and showmovies.pml. These files are part of the system's web interface that handles configuration presets for Pan-Tilt-Zoom cameras and video playback controls respectively. The vulnerability is triggered through the size parameter, which appears to be used in these modules without adequate encoding or filtering of special characters such as angle brackets, quotes, and ampersands. This lack of proper sanitization allows an attacker to inject malicious client-side scripts into pages viewed by other users or administrators interacting with the surveillance system's web portal.
From a technical perspective, this vulnerability falls under CWE-79, which is categorized as Improper Neutralization of Input During Web Page Generation commonly known as Cross-site Scripting. The attack vector involves an attacker crafting a malicious URL or form submission that includes script payloads within the size parameter value. When the C-MOR system processes this input and reflects it back into the HTML response without proper encoding, the browser interprets the injected content as executable JavaScript rather than plain text. This execution occurs in the context of the victim's session with the web application, granting the attacker the same privileges as a legitimate user logged into the surveillance interface. The presence of this flaw in both ptzpreset.pml and showmovies.pml suggests that the underlying framework or template engine used by za-internet GmbH fails to enforce strict output encoding across multiple functional areas of the application, indicating a systemic issue rather than an isolated coding error.
The operational impact of exploiting this vulnerability is significant for organizations relying on C-MOR Video Surveillance for physical security monitoring. An attacker who successfully exploits this flaw can perform actions such as stealing session cookies or authentication tokens, thereby hijacking administrative accounts and gaining full control over the surveillance infrastructure. This could lead to unauthorized viewing of live feeds, manipulation of camera presets, deletion of recorded footage, or even further exploitation by using the compromised system as a pivot point for lateral movement within the corporate network. Additionally, attackers can deface the web interface, redirect users to phishing sites, or deploy malware onto client machines through drive-by download techniques if combined with other vulnerabilities in browser plugins or active content handlers. The ability to execute arbitrary code remotely without authentication highlights the severity of this issue, as it lowers the barrier for entry significantly compared to authenticated attacks.
In terms of threat modeling and industry frameworks, this vulnerability aligns with MITRE ATT&CK technique T1059, specifically sub-technique 007 which covers JavaScript execution. The attack scenario typically involves Initial Access through a targeted link or compromised page leading to Execution via the injected script within the victim's browser environment. If the attacker gains administrative access due to session hijacking facilitated by this XSS flaw, it may also relate to T1556, Credential Phishing or Modification of Authentication Processes, as well as potential persistence mechanisms if scripts are stored in persistent storage areas managed by the application. The lack of input validation on critical parameters like size indicates a failure in implementing secure coding practices recommended by OWASP Top 10, particularly regarding Injection and Broken Access Control principles where user inputs must be treated as untrusted data until proven safe through rigorous filtering and encoding strategies.
Mitigation for this vulnerability requires immediate action from system administrators and the vendor. The primary remediation step is to apply any available patches or updates provided by za-internet GmbH that address these specific flaws in ptzpreset.pml and showmovies.pml. If no patch is immediately available, temporary mitigations should include implementing a Web Application Firewall rule set designed to detect and block common XSS payloads within URL parameters and POST data fields. Additionally, administrators can restrict access to the web management interface by placing it behind strong authentication mechanisms such as multi-factor authentication or restricting IP addresses allowed to connect via firewall rules. Enabling HTTP-only flags on session cookies can also mitigate some risks associated with cookie theft through this specific vector. Long-term resolution involves a comprehensive code review focusing on output encoding practices across all dynamic content generation modules within the C-MOR platform, ensuring that data is always encoded according to its context before being rendered in HTML documents.