SQL Injection in tribalsystems/zenario

2022-03-1817:49:01

Google

osv.dev

0.002 Low

EPSS

Percentile

54.0%

JSON

SQL Injection in Tribalsystems Zenario CMS 8.8.52729 and prior allows remote attackers to access the database or delete the plugin. This is accomplished via the ID input field of ajax.php in the Pugin library - delete module.

CPENameOperatorVersion
tribalsystems/zenarioeq7.7.47369
tribalsystems/zenarioeq7.7.48583
tribalsystems/zenarioeq8.1.46433
tribalsystems/zenarioeq8.0.47180
tribalsystems/zenarioeq7.6.47180
tribalsystems/zenarioeq7.7.47180
tribalsystems/zenarioeq8.0.44273
tribalsystems/zenarioeq8.2.47369
tribalsystems/zenarioeq8.4.51340
tribalsystems/zenarioeq8.1.45530

Name	Operator	Version
tribalsystems/zenario	eq	7.7.47369
tribalsystems/zenario	eq	7.7.48583
tribalsystems/zenario	eq	8.1.46433
tribalsystems/zenario	eq	8.0.47180
tribalsystems/zenario	eq	7.6.47180
tribalsystems/zenario	eq	7.7.47180
tribalsystems/zenario	eq	8.0.44273
tribalsystems/zenario	eq	8.2.47369
tribalsystems/zenario	eq	8.4.51340
tribalsystems/zenario	eq	8.1.45530