# Xibo CMS SQL injection, cross-site scripting and CSRF flaws disclosed

- Date: 2014-01-29
- Location: Global
- Type: Vulnerability
- Sector: Vendor
- CVE: CVE-2013-4887, CVE-2013-4888, CVE-2013-4889
- Products: [Xibo](https://signagelist.org/products/xibo/)

NVD published 3 vulnerabilities in Xibo CMS, covering SQL injection, cross-site scripting and CSRF. SQL injection vulnerability in index.php in Digital Signage Xibo 1.4.2 allows remote attackers to execute arbitrary SQL commands via the displayid parameter.

## Sources

- [CVE-2013-4887](https://nvd.nist.gov/vuln/detail/CVE-2013-4887) (NIST NVD)
- [CVE-2013-4888](https://nvd.nist.gov/vuln/detail/CVE-2013-4888) (NIST NVD)
- [CVE-2013-4889](https://nvd.nist.gov/vuln/detail/CVE-2013-4889) (NIST NVD)
- [http://infosec42.blogspot.com/2013/08/exploit-xibo-digital-signage-sql.html](http://infosec42.blogspot.com/2013/08/exploit-xibo-digital-signage-sql.html)
- [http://www.securityfocus.com/bid/62071](http://www.securityfocus.com/bid/62071)

Page: https://signagelist.org/incidents/2014-01-xibo-cms-sql-injection-cross-site-scripting/