Znuny: SQL injection in ticket search via ContentSearch parameter
Summary
Znuny, an open-source ticketing system based on OTRS, does not validate the ContentSearch parameter of the ticket search. The value is inserted directly into the SQL query in Kernel::System::Ticket::TicketSearch and Kernel::System::Ticket::ArticleSearchIndex::DB. An attacker with a valid low-privileged account can inject SQL commands to read, modify or delete database data, or cause a denial of service. Unauthenticated exploitation is not described in the advisory.
Affected
- Znuny LTS 6.5.1 to 6.5.24
- Znuny 7.3.1 to 7.3.6
- Znuny 6.0, 6.1, 6.2, 6.3, 6.4, 7.0, 7.1 and 7.2 (all versions)
- CNA data: before 6.5.25 and 7.0.0 to before 7.3.7
Fixed in
- Znuny LTS 6.5.25
- Znuny 7.3.7
Workaround
Unknown. No vendor-documented workaround was found. Upgrading is the only confirmed remediation.
Exploitation
- No public exploit known (VulDB).
- No evidence of exploitation in the wild. CISA SSVC lists exploitation as none and automatable as no.
- EPSS: 0.003.
Our recommendation
- Upgrade to Znuny LTS 6.5.25 or Znuny 7.3.7.
- Prioritise this update together with the related high-severity fixes ZSA-2026-13 (CVE-2026-48188) and ZSA-2026-14 (CVE-2026-93483).
- Verify that HTTPBasicAuth is not used as an authentication backend, or review it.
- Review which accounts can use ticket search and restrict external access to the agent interface.
- Monitor database and application logs for unusual search queries.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Znuny advisory ZSA-2026-15 www.znuny.org
- Znuny advisories index www.znuny.org
- VulDB CVE-2026-93484 vuldb.com
- Ubuntu security CVE-2026-93484 ubuntu.com
- OpenCVE CVE-2026-93484 app.opencve.io
- Vulners CVE-2026-93484 vulners.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 08:07.
Original description (NVD)
Znuny through 7.3.6 constructs a ticket-search database query by directly concatenating user-supplied input into the SQL statement. This lack of proper sanitization or the use of parameterized queries allows an attacker to inject arbitrary SQL commands, leading to data theft, modification, or denial of service. Specifically this is in Kernel::System::Ticket::TicketSearch and Kernel::System::Ticket::ArticleSearchIndex::DB via the ContentSearch parameter. The parameter is expected to be either "AND" or "OR", but its value was concatenated directly into the generated SQL query without validation.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.