OS Command Injection in ZoneMinder daemonControl()

This repository is a small standalone Python proof-of-concept exploit for CVE-2023-26039 affecting ZoneMinder. It contains one executable script, CVE-2023-26039.py, and a README with setup and usage examples. The script uses the requests library and argparse for CLI handling. Exploit flow: first, it authenticates to the ZoneMinder API by POSTing credentials to /api/host/login.json and extracting an access_token from the JSON response. Second, it constructs a shell payload, base64-encodes it, and wraps it in a bash execution primitive to reduce quoting issues. Third, it sends a POST request to /api/host/daemonControl/{daemon}.pl/{cmd}.json with parameters token, command=start, and a malicious action value of the form logrotate&<cmd>&. The action parameter is the actual injection point used to achieve authenticated OS command execution. Capabilities: the exploit supports arbitrary command execution via the -c option and a built-in reverse shell mode via -lh/-lp, which generates a bash /dev/tcp reverse shell. The default daemon argument in code is zmdc.pl, and because the URL template appends .pl again, the resulting path may appear as zmdc.pl.pl in output/examples; despite that quirk, the intended target is the daemonControl API path. Repository structure is minimal and purpose-built: one Python exploit script and one documentation file. This is a real exploit, not a detector, and it is operational because it includes a usable payload path for both command execution and reverse shell access.