GitHub Advisoryadvisory · Packagist

GHSA-w4f3-7f7c-x652 SQL Injection in tribalsystems/zenario

CRITICAL Published 2022-03-18 Modified 2022-03-18 Official page ↗
Aliases
CVE-2021-26830
Ecosystem
Packagist
Packages
tribalsystems/zenario
Severity
Critical
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Weaknesses
CWE-89
Reviewed
2021-05-06

Affected packages

• Packagist tribalsystems/zenario: < 8.8.53370 → fixed in 8.8.53370

Description

SQL Injection in Tribalsystems Zenario CMS 8.8.52729 and prior allows remote attackers to access the database or delete the plugin. This is accomplished via the `ID` input field of ajax.php in the `Pugin library - delete` module.

Related

Alias · CVE (1)

  • CVE-2021-26830 SQL Injection in Tribalsystems Zenario CMS 8.8.52729 allows remote attackers to access the database or delete the plugin. vulnerability

Weakness · CWE (1)

  • CWE-89 Improper Neutralization of Special Elements used in an SQL Command weakness

References