SQL Injection in tribalsystems/zenario

2021-06-0820:12:02

Google

osv.dev

0.001 Low

EPSS

Percentile

40.3%

JSON

SQL Injection in the “admin_boxes.ajax.php” component of Tribal Systems Zenario CMS v8.8.52729 allows remote attackers to obtain sesnitive database information by injecting SQL commands into the “cID” parameter when creating a new HTML component.

CPENameOperatorVersion
tribalsystems/zenarioeq7.7.47369
tribalsystems/zenarioeq7.7.48583
tribalsystems/zenarioeq8.1.46433
tribalsystems/zenarioeq8.0.47180
tribalsystems/zenarioeq7.6.47180
tribalsystems/zenarioeq7.7.47180
tribalsystems/zenarioeq8.0.44273
tribalsystems/zenarioeq8.2.47369
tribalsystems/zenarioeq8.4.51340
tribalsystems/zenarioeq8.1.45530

Name	Operator	Version
tribalsystems/zenario	eq	7.7.47369
tribalsystems/zenario	eq	7.7.48583
tribalsystems/zenario	eq	8.1.46433
tribalsystems/zenario	eq	8.0.47180
tribalsystems/zenario	eq	7.6.47180
tribalsystems/zenario	eq	7.7.47180
tribalsystems/zenario	eq	8.0.44273
tribalsystems/zenario	eq	8.2.47369
tribalsystems/zenario	eq	8.4.51340
tribalsystems/zenario	eq	8.1.45530