(:A local file inclusion vulnerability has been identified in ZoneMinder.:An authenticated remote attacker could exploit it in order to read arbitrary file with the rights of web server (www-data) via a specially crafted HTTP request.::This vulnerability stems from a lack of validation upon user-supplied input passed to the "readfile()" function in the "views/file.php" source file.::A proof of concept is available.::The zoneminder packages provided by Debian Wheezy 7 are vulnerable.)
