Description
Xibo is a content management system (CMS). An SQL injection vulnerability was discovered in the `report/data/proofofplayReport` API route inside the CMS. This allows an authenticated user to to obtain and modify arbitrary data from the Xibo database by injecting specially crafted values in to the `sortBy` parameter. Users should upgrade to version 3.3.12 or 4.0.14 which fix this issue.
References (3)
Core 3
Core References
Vendor Advisory x_refsource_confirm
https://github.com/xibosignage/xibo-cms/security/advisories/GHSA-v6q4-h869-gm3r
Patch x_refsource_misc
https://github.com/xibosignage/xibo-cms/commit/c60cfd8727da77b9db10297148eadd697ebec353.patch
Various Sources x_refsource_misc
https://xibosignage.com/blog/security-advisory-2024-07
Scores
CVSS v3
6.5
EPSS
0.0044
EPSS Percentile
35.5%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N
CISA SSVC
Vulnrichment
Exploitation
none
Automatable
no
Technical Impact
total
Details
CWE
CWE-89
Status
published
Products (2)
xibosignage/xibo-cms
=> 2.1.0, < 3.3.12
xibosignage/xibo-cms
=> 4.0.0-alpha, < 4.0.14
Published
Jul 30, 2024
Tracked Since
Feb 18, 2026