The C-MOR Video Surveillance web interface contains a critical path traversal vulnerability that allows unauthenticated attackers to access sensitive system files.

This is a path traversal vulnerability (CWE-22) residing in the show-movies.pml script. An unauthenticated attacker can exploit the 'cam' parameter to traverse the file system and retrieve unauthorized files.

Successful exploitation allows an attacker to read arbitrary files from the host server, which may include configuration files, credentials, or other sensitive system data. Given the CVSS score of 7.5, this high-severity vulnerability poses a significant risk to data confidentiality and could serve as a precursor to further system compromise.

Immediate Action: Upgrade the C-MOR Video Surveillance software to the latest available version provided by the vendor to patch the vulnerable show-movies.pml script.

Proactive Monitoring: Review web server access logs for anomalous requests containing directory traversal sequences, such as dot-dot-slash patterns, targeting the show-movies.pml endpoint.

Compensating Controls: Deploy a Web Application Firewall (WAF) rule to inspect and block incoming HTTP requests that contain path traversal characters in the 'cam' parameter.

Public Exploit Available: Yes, an ExploitDB entry exists.

This vulnerability represents a high-risk security flaw that can be exploited by unauthenticated remote actors. Organizations currently running C-MOR Video Surveillance versions 6.0104 or earlier should prioritize applying the vendor-supplied update immediately. If patching is not immediately feasible, restrict network access to the web interface and implement stringent WAF filtering to mitigate the risk of unauthorized file disclosure.