CVE-2023-33179
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk45th percentile - higher than 45% of all known CVEs
Summary
An SQL injection vulnerability was discovered in the `nameFilter` function in the Xibo content management system, affecting versions from 3.2.0 to 3.3.5. This allows an authenticated user to exfiltrate data from the Xibo database by injecting specially crafted values for logical operators.
Risk Assessment
This vulnerability could lead to unauthorized access to sensitive data in the database, posing a serious security threat to the organization.
Recommendation
It is recommended to upgrade to version 3.3.5, which fixes this issue. There are no known workarounds aside from upgrading.
Original NVD description (English source)
Xibo is a content management system (CMS). An SQL injection vulnerability was discovered starting in version 3.2.0 and prior to version 3.3.5 in the `nameFilter` function used throughout the CMS. This allows an authenticated user to exfiltrate data from the Xibo database by injecting specially crafted values for logical operators. Users should upgrade to version 3.3.5 which fixes this issue. There are no known workarounds aside from upgrading.