Cross Site Scripting (XSS) in the "admin_boxes.ajax.php" component of Tribal Systems Zenario CMS v8.8.52729 allows remote attackers to execute arbitrary code by injecting arbitrary HTML into the "cID" parameter when creating a new HTML component.
References
Link | Resource |
---|---|
http://packetstormsecurity.com/files/163083/Zenario-CMS-8.8.52729-SQL-Injection.html | Exploit Third Party Advisory VDB Entry |
https://deadsh0t.medium.com/blind-error-based-authenticated-sql-injection-on-zenario-8-8-52729-cms-d4705534df38 | Exploit Third Party Advisory |
Configurations
History
23 May 2022, 22:42
Type | Values Removed | Values Added |
---|---|---|
References | (MISC) http://packetstormsecurity.com/files/163083/Zenario-CMS-8.8.52729-SQL-Injection.html - Exploit, Third Party Advisory, VDB Entry |
11 Jun 2021, 17:15
Type | Values Removed | Values Added |
---|---|---|
References |
|
21 Apr 2021, 19:17
Type | Values Removed | Values Added |
---|---|---|
CPE | cpe:2.3:a:tribalsystems:zenario:8.8.52729:*:*:*:*:*:*:* | |
References | (MISC) https://deadsh0t.medium.com/blind-error-based-authenticated-sql-injection-on-zenario-8-8-52729-cms-d4705534df38 - Exploit, Third Party Advisory | |
CVSS |
v2 : v3 : |
v2 : 3.5
v3 : 4.8 |
CWE | CWE-79 |
15 Apr 2021, 14:37
Type | Values Removed | Values Added |
---|---|---|
New CVE |
Information
Published : 2021-04-15 14:15
Updated : 2023-12-10 13:55
NVD link : CVE-2021-27673
Mitre link : CVE-2021-27673
CVE.ORG link : CVE-2021-27673
JSON object : View
Products Affected
tribalsystems
- zenario
CWE
CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')