Technical impact
A remote authenticated user who holds users_mod privileges can craft a POST request to tools.php?action=manage_tags containing a malicious tagid or type parameter. The system fails to validate or escape these inputs, allowing the attacker to inject arbitrary SQL commands into the database engine. This flaw can write, delete, or read any data in the database, potentially exposing sensitive information or allowing an attacker to alter the application state.
Affected Systems
GazellePosterWall (GazellePW) instances that are running the code at revision 86c4bedf727691b5a97af42a4864869d18446449, or any downstream releases that have not applied a fix for this commit. No specific vendor product names or version ranges are publicly identified beyond the repository reference.
Risk and Exploitability
The vulnerability is exploitable remotely by users who already possess users_mod privileges, making it a privilege-based threat vector that does not require public disclosure. The CVSS score of 5.4 indicates a moderate severity, while the EPSS rate of <1% shows a low probability of exploitation. The issue is not listed in the CISA KEV catalog. As with any arbitrary‑SQL injection, attackers could read, modify or delete database data, potentially compromising sensitive information or application state. Given the lack of mitigation in the current code, exploitation is straightforward if an attacker can acquire users_mod rights.
