An authenticated SQL injection vulnerability in Xibo CMS versions 1.7 through 4.4.0 allows attackers with specific low-level privileges to compromise database integrity and confidentiality.

This vulnerability is an SQL injection flaw (CWE-89) located within the API routes responsible for filtering DataSets. It allows an authenticated user, who possesses either the Access to DataSet Feature or the Access to the Layout Feature privilege, to inject malicious SQL queries to read or modify database content.

Successful exploitation of this vulnerability could lead to unauthorized access to sensitive information stored within the Xibo database or the unintended modification of digital signage content. Given the CVSS score of 7.6, this represents a high-severity risk that could undermine the integrity of the content management system and lead to operational disruption. If the database contains administrative credentials or configuration data, the impact could escalate to full system compromise.

Immediate Action: Upgrade Xibo CMS to version 4.4.1 or the latest available patch for legacy versions 3.3, 2.3, or 1.8 to resolve the underlying SQL injection flaw.

Proactive Monitoring: Review application access logs for unusual API traffic patterns, particularly requests containing unexpected SQL syntax or character sequences within the filter parameters.

Compensating Controls: Implement a Web Application Firewall (WAF) with rules configured to detect and block common SQL injection patterns targeting REST API parameters.

Public Exploit Available: Unknown

Organizations utilizing Xibo CMS should prioritize applying the provided security updates immediately. Because this vulnerability allows for data modification via the API, failing to patch exposes the platform to persistent unauthorized changes that may be difficult to detect after the fact. Apply the vendor-supplied patches to restore the security of your digital signage management environment.