Cristian Castrechini

ZIRA Group WBRM version 7.0 is susceptible to a SQL Injection issue occurring in the `referenceLookupsByTableNameAndColumnName` function. The issue allows for potential manipulation of database queries through crafted input.

The issue is related to the XML Database component, allowing a low-privileged attacker with network access via HTTP to compromise the XML Database. Successful attacks require human interaction and can result in unauthorized update, insert, or delete access to some XML Database accessible data, as well as unauthorized read access to a subset of XML Database accessible data.

The issue is related to the storage of passwords in plain text. This could allow an attacker to disclose protected information. A local user can read the user credentials stored in plain text.