CVE-2019-15016
published 2019-10-09CVE-2019-15016: An SQL injection vulnerability exists in the management interface of Zingbox Inspector versions 1.288 and earlier, that allows for unsanitized data provided by…
PriorityP349high8.8CVSS 3.1
AVNACLPRLUINSUCHIHAH
EPSS
1.16%
63.2th percentile
An SQL injection vulnerability exists in the management interface of Zingbox Inspector versions 1.288 and earlier, that allows for unsanitized data provided by an authenticated user to be passed from the web UI into the database.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| paloalto | zingbox_inspector | — | — |
| zingbox | inspector | <= 1.288 | — |
CVSS provenance
nvdv3.18.8HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
nvdv2.06.5MEDIUMAV:N/AC:L/Au:S/C:P/I:P/A:P
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Palo Alto
SQL Injection in Zingbox Inspector
vendor_paloalto·2019-10-01·CVSS 8.8
CVE-2019-15016 [HIGH] CWE-89 SQL Injection in Zingbox Inspector
SQL Injection in Zingbox Inspector
An SQL injection vulnerability exists in the Zingbox Inspector management interface that allows for unsanitized data provided by an authenticated user to be passed from the web UI into the database. (Ref: CVE-2019-15016)
The vulnerability allows for authenticated users to pass unsanitized commands to the Zingbox Inspector backend database, potentially causing compromise or other harm to the database or system.
This issue affects Zingbox Inspector, versions 1.288 and earlier.
Affected products: Zingbox Inspector
Solution: Zingbox Inspector, version 1.289 and later.
Workaround: In the normal course of operation, Zingbox Inspector automatically updates its own software, and a fixed version of software has already been made available. No user action is re
GHSA
GHSA-fh6x-ww24-xf7w: An SQL injection vulnerability exists in the management interface of Zingbox Inspector versions 1
ghsa_unreviewed·2022-05-24
CVE-2019-15016 [HIGH] CWE-89 GHSA-fh6x-ww24-xf7w: An SQL injection vulnerability exists in the management interface of Zingbox Inspector versions 1
An SQL injection vulnerability exists in the management interface of Zingbox Inspector versions 1.288 and earlier, that allows for unsanitized data provided by an authenticated user to be passed from the web UI into the database.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2019-10-09
Published