Vulners
Lucene search
Zenario CMS 8.8.52729 - 'cID' SQL injection (Authenticated)
| Reporter | Title | Published | Views | Family All 11 |
|---|---|---|---|---|
 | Zenario CMS 8.8.52729 - (cID) Blind & Error based SQL injection (Authenticated) Vulnerability | 11 Jun 202100:00 | – | zdt |
 | Zenario CMS 跨站脚本漏洞 | 15 Apr 202100:00 | – | cnnvd |
 | CVE-2021-27673 | 15 Apr 202113:51 | – | cve |
 | CVE-2021-27673 | 15 Apr 202113:51 | – | cvelist |
 | EUVD-2021-1293 | 7 Oct 202500:30 | – | euvd |
 | reflected XSS in tribalsystems/zenario | 8 Jun 202120:11 | – | github |
 | CVE-2021-27673 | 15 Apr 202114:15 | – | nvd |
 | GHSA-8HCM-JJ4X-4GMR reflected XSS in tribalsystems/zenario | 8 Jun 202120:11 | – | osv |
 | Zenario CMS 8.8.52729 SQL Injection | 11 Jun 202100:00 | – | packetstorm |
 | Cross site scripting | 15 Apr 202114:15 | – | prion |
10
# Exploit Title: Zenario CMS 8.8.52729 - 'cID' Blind & Error based SQL injection (Authenticated)
# Date: 05–02–2021
# Exploit Author: Avinash R
# Vendor Homepage: https://zenar.io/
# Software Link: https://github.com/TribalSystems/Zenario/releases/tag/8.8
# Version: 8.8.52729
# Tested on: Windows 10 Pro (No OS restrictions)
# CVE : CVE-2021–27673
# Reference: https://deadsh0t.medium.com/blind-error-based-authenticated-sql-injection-on-zenario-8-8-52729-cms-d4705534df38
##### Step To Reproduce #####
1) Login to the admin page of Zenario CMS with admin credentials, which is
http://server_ip/zenario/admin.php
2) Click on, New → HTML page to create a new sample page and intercept it
with your interceptor.
3) Just a single quote on the 'cID' parameter will confirm the SQL
injection.
4) After confirming that the 'cID' parameter is vulnerable to SQL
injection, feeding the request to SQLMAP will do the rest of the work for
you.
############ End ############Data
Build on a solid foundation with Vulners data
We provide the essential building blocks for cybersecurity solutions with comprehensive, structured, and constantly updated vulnerability and exploits data
Api
Power your application with Vulners API
The Vulners REST API offers reliable, high-performance access to vulnerability intelligence, with 99.9% SLA uptime and CDN-backed data delivery for seamless global access
App
Assess and manage vulnerabilities with Vulners tools
Built on top of Vulners' database and SDK, end-user solutions give security professionals and developers lightweight and powerful tools for vulnerability remediation
11 Jun 2021 00:00Current
7.4High risk
Vulners AI Score7.4
CVSS 23.5
CVSS 3.14.8
EPSS0.00222