GHSA-8hcm-jj4x-4gmr

reflected XSS in tribalsystems/zenario

Source: GitHub Advisory Database (reviewed) Moderate CVE-2021-27673

Packages

Ecosystem	Package	Affected	Fixed in
Packagist	tribalsystems/zenario	< 8.8.53370	8.8.53370

Details

As written in the advisory (Markdown source, shown as plain text).

Reflected XSS in the "admin_boxes.ajax.php" component of Tribal Systems Zenario CMS v8.8.52729 allows remote attackers to execute arbitrary code by injecting into the "cID" parameter when creating a new HTML component.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2021-27673 advisory
https://deadsh0t.medium.com/blind-error-based-authenticated-sql-injection-on-zenario-8-8-52729-cms-d4705534df38 web
https://github.com/TribalSystems/Zenario package
https://github.com/TribalSystems/Zenario/releases/tag/8.8.53370 web
http://packetstormsecurity.com/files/163083/Zenario-CMS-8.8.52729-SQL-Injection.html web