GitHub Advisoryadvisory · Packagist

GHSA-gxcm-36qw-j29v SQL Injection in tribalsystems/zenario

MEDIUM Published 2021-06-08 Modified 2021-05-07 Official page ↗
Aliases
CVE-2021-27672
Ecosystem
Packagist
Packages
tribalsystems/zenario
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-89
Reviewed
2021-05-07

Affected packages

• Packagist tribalsystems/zenario: < 8.8.53370 → fixed in 8.8.53370

Description

SQL Injection in the "admin_boxes.ajax.php" component of Tribal Systems Zenario CMS v8.8.52729 allows remote attackers to obtain sesnitive database information by injecting SQL commands into the "cID" parameter when creating a new HTML component.

Related

Alias · CVE (1)

  • CVE-2021-27672 SQL Injection in the "admin_boxes.ajax.php" component of Tribal Systems Zenario CMS v8.8.52729 allows remote attackers to obtain sesnitive… vulnerability

Weakness · CWE (1)

  • CWE-89 Improper Neutralization of Special Elements used in an SQL Command weakness

References