CVE-2021-26830 SQL Injection in tribalsystems/zenario
Remote attackers can exploit SQL injection in Zenario CMS to access the database or delete plugins via the ID input field.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2021-26830?
CVE-2021-26830 is a critical SQL injection vulnerability in n/a, published on 16 Apr 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
SQL Injection in Tribalsystems Zenario CMS 8.8.52729 allows remote attackers to access the database or delete the plugin. This is accomplished via the `ID` input field of ajax.php in the `Pugin library - delete` module.
Weakness: CWE-89
Which versions are affected by CVE-2021-26830?
2 open source packages ship an affected version, including tribalsystems/zenario. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
tribalsystems/zenario Packagist | All versions | 8.8.53370 |
tribalsystems/zenario Packagist | All versions | 8.8.53370 |
Products include Tribalsystems Zenario.
How do I fix CVE-2021-26830?
Upgrade tribalsystems/zenario to 8.8.53370 or later.
Use parameterised queries everywhere and never build SQL by joining strings. Upgrade affected software first; a web application firewall only buys time. More about SQL injection.
Is CVE-2021-26830 being exploited?
There is no known exploitation of CVE-2021-26830 in the wild and no public exploit code.
Public exploit code: 1 Exploit-DB entry.
Other vulnerabilities in n/a
- CVE-2022-44136 Zenario CMS is vulnerable to Remote Code Execution (RCE).
- CVE-2018-18420 Zenario CMS vulnerable to CSRF
- CVE-2018-5960 SQL Injection in Zenario 7.1-7.6
- CVE-2021-42171 Unrestricted Upload of File with Dangerous Type in Zenario CMS
- CVE-2022-23043 File upload restriction bypass in Zenario CMS
Sources
Also known as GHSA-w4f3-7f7c-x652.