CVE-2021-27673

Vulnerability

A Cross-Site Scripting (XSS) vulnerability exists in the admin_boxes.ajax.php component of Tribal Systems Zenario CMS version 8.8.52729. An attacker can inject arbitrary HTML or JavaScript into the cID parameter when creating a new HTML component, leading to code execution in the context of the admin panel. [1]

Exploitation

To exploit this vulnerability, an attacker must have administrator-level access to the Zenario CMS. The attacker creates an HTML component and supplies a malicious payload in the cID parameter. When the component is rendered or processed, the injected script executes in the browser of an admin viewing the affected page. No user interaction beyond normal admin actions is required. [1]

Impact

Successful exploitation allows the attacker to execute arbitrary JavaScript in the context of the admin panel. This can lead to session hijacking, data exfiltration, or further compromise of the CMS instance depending on admin privileges. [1]

Mitigation

The vulnerability is addressed in Zenario version 8.8.53370, which was released as a security update. [2] Users should upgrade to this version or later. If upgrading is not immediately possible, restrict admin panel access to trusted users only. No KEV listing has been reported. [3]