Znuny SQL Injection in Ticket Search Allows Data Theft
Unpatched Znuny instances are vulnerable to SQL injection via the ContentSearch parameter, risking unauthorized access to ticket data.
Key points
- Znuny versions prior to 7.3.7 contain a high-severity SQL injection flaw.
- The vulnerability resides in the ContentSearch parameter used for ticket queries.
- Attackers can exploit this to steal, modify, or disrupt database operations.
Znuny ticketing system users face a high-severity security risk due to a SQL injection vulnerability in versions through 7.3.6. According to the National Vulnerability Database record for CVE-2026-93484, the flaw allows attackers to inject arbitrary SQL commands into database queries. This exposure affects environments where the ContentSearch parameter is processed without proper sanitization, potentially leading to significant data compromise or service disruption for security operations teams.
Root cause
The vulnerability stems from how Znuny constructs database queries in specific system components. The application directly concatenates user-supplied input into SQL statements within Kernel::System::Ticket::TicketSearch and Kernel::System::Ticket::ArticleSearchIndex::DB. This lack of input validation or the use of parameterized queries creates an entry point for malicious code execution.
Attack path
An attacker targets the ContentSearch parameter, which is expected to hold only "AND" or "OR" values. However, the system fails to validate this input before inserting it into the generated SQL query. By supplying crafted strings instead of the expected logical operators, an attacker can manipulate the database query structure to execute unauthorized commands.
Affected versions
- Znuny versions before 6.5.25
- Znuny versions before 7.3.7
Mitigation
- Upgrade to Znuny version 7.3.7 or later for the 7.x branch.
- Upgrade to Znuny version 6.5.25 or later for the 6.x branch.
- Restrict access to the ticket search functionality if immediate patching is not possible.
Detection notes
Security teams should monitor database logs for unexpected query structures or errors related to syntax issues in the ticket search modules. Look for spikes in query complexity or unusual response times from the search endpoints. Check for unauthorized data access patterns or modifications to ticket records that do not align with normal user behavior. Isolate affected instances if suspicious activity is confirmed to prevent further data exfiltration or lateral movement within the network environment.
Background: Data exfiltration
Data exfiltration prevention requires monitoring outbound traffic for anomalies, restricting user permissions through strict access controls, and encrypting sensitive files at rest. You must detect unusual data movement patterns early, block unauthorized transfer methods, and verify that backup systems remain intact to limit exposure during a breach.
Read the full guide: Data Exfiltration Prevention: Stop Hidden Data Theft Before It Escapes
What to do and how to stay safe: Znuny
- Verify your current Znuny version against the affected list provided by the vendor.
- Review database logs for anomalous SQL syntax errors or unexpected query patterns.
- Restrict network access to the Znuny interface until patches are applied.
- Monitor for unauthorized changes to ticket data or user credentials.
Step-by-step guide: SQL Injection Mistakes That Leave Your Database Exposed
General security guidance from the BlueTeam Insider newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is the CVSS score for CVE-2026-93484?
The National Vulnerability Database rates the severity as 8.6, which is classified as HIGH.
Which specific parameter is vulnerable in Znuny?
The ContentSearch parameter is vulnerable because it is concatenated directly into SQL queries without validation.
Is there a fix available for this vulnerability?
Yes, upgrading to Znuny version 7.3.7 or 6.5.25 resolves the issue according to the vulnerability record.
