critical9.1Public exploit code
CVE-2021-26830
SQL Injection in tribalsystems/zenario
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- Zenario CMS 8.8.53370 - 'id' Blind SQL Injection2021-03-15 · webapps · php
Impact
SQL Injection in Tribalsystems Zenario CMS 8.8.52729 and prior allows remote attackers to access the database or delete the plugin. This is accomplished via the `ID` input field of ajax.php in the `Pugin library - delete` module.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| composer | tribalsystems/zenario | < 8.8.53370 | 8.8.53370 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Tribalsystems | Zenario | Version 8.8.52729 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://github.com/TribalSystems/Zenario/releases/tag/8.8.53370
- https://github.com/advisories/GHSA-w4f3-7f7c-x652
- https://nvd.nist.gov/vuln/detail/CVE-2021-26830
- https://github.com/TribalSystems/Zenario/commit/2c82a4d126c8446106347ef603b157f2d4175fd1
- https://edhunter484.medium.com/blind-sql-injection-on-zenario-cms-b58b6820c32d
- https://www.exploit-db.com/exploits/49642