Sql injection

A Blind SQL Injection Vulnerability in Exponent CMS through 2.4.0, with the rerank array parameter, can lead to site database information disclosure and denial of service...

CVE-2016-9272

A Blind SQL Injection Vulnerability in Exponent CMS through 2.4.0, with the rerank array parameter, can lead to site database information disclosure and denial of service...

CVE-2016-9272

A Blind SQL Injection Vulnerability in Exponent CMS through 2.4.0, with the rerank array parameter, can lead to site database information disclosure and denial of service...

CVE-2016-9272

Exponent CMS before version 2.4.0 contains a blind SQL injection via the rerank array parameter that can lead to partial database information disclosure and denial of service. This is documented across CVE-2016-9272 entries (NVD, CNVD/OSV). The core issue is an injectable parameter in the rerank ...

CVE-2016-9272

A Blind SQL Injection Vulnerability in Exponent CMS through 2.4.0, with the rerank array parameter, can lead to site database information disclosure and denial of service...

CVE-2016-9283: Improper Neutralization of Special Elements used in an SQL Command

SQL Injection in framework/core/subsystems/expRouter.php in Exponent CMS v2.4.0 allows remote attackers to read database information via address/addContentToSearch/id/ and a trailing string, related to a "sef URL" issue...

CVE-2016-9272: Improper Neutralization of Special Elements used in an SQL Command

A Blind SQL Injection Vulnerability in Exponent CMS through 2.4.0, with the rerank array parameter, can lead to site database information disclosure and denial of service...

CVE-2016-9286: Exposure of Sensitive Information to an Unauthorized Actor

framework/modules/users/controllers/usersController.php in Exponent CMS v2.4.0patch1 does not properly restrict access to user records, which allows remote attackers to read address information, as demonstrated by an address/show/id/1 URI...

CVE-2016-9288: Improper Neutralization of Special Elements used in an SQL Command

In framework/modules/navigation/controllers/navigationController.php in Exponent CMS v2.4.0 or older, the parameter "target" of function "DragnDropReRank" is directly used without any filtration which caused SQL injection. The payload can be used like this: /navigation/DragnDropReRank/target/1...

Exponent CMS 2.4.0 Blind SQL Injection Vulnerability

Exponent CMS version 2.4.0 suffers from a remote blind SQL injection vulnerability...

CVE-2016-9282: Improper Neutralization of Special Elements used in an SQL Command

SQL Injection in framework/modules/search/controllers/searchController.php in Exponent CMS v2.4.0 allows remote attackers to read database information via action=search&module=search with the searchstring parameter...

CVE-2016-9284: Exposure of Sensitive Information to an Unauthorized Actor

getUsersByJSON in framework/modules/users/controllers/usersController.php in Exponent CMS v2.4.0 allows remote attackers to read user information via users/getUsersByJSON/sort/ and a trailing string...

CVE-2016-9285: Exposure of Sensitive Information to an Unauthorized Actor

framework/modules/addressbook/controllers/addressController.php in Exponent CMS v2.4.0 allows remote attackers to read user information via a modified id number, as demonstrated by address/edit/id/1, related to an "addresses, countries, and regions" issue...

PT-2016-7720

Name of the Vulnerable Software and Affected Versions Exponent CMS version 2.4.0 Description The issue allows remote attackers to read database information. This is achieved by exploiting the search string parameter in the "action=search&module=search" API endpoint. Recommendations For Exponent C...

Exponent CMS 2.4.0 Blind SQL Injection

Document Title: =============== Blind SQL Injection Vulnerability in Exponent CMS 2.4.0 References Source: ==================== https://exponentcms.lighthouseapp.com/projects/61783/tickets/1394-blind-sql-injection-vulnerability-in-exponent-cms-240-4...

Exponent CMS SQL Injection Vulnerability (CNVD-2016-10804)

Exponent is a web content management system. Multiple SQL injection vulnerabilities exist in the framework/modules/core/controllers/expRatingController.php/update method in Exponent CMS version 2.4.0, which can be exploited by an authenticated remote user to execute arbitrary SQL commands via the...

CVE-2016-9242

Multiple SQL injection vulnerabilities in the update method in framework/modules/core/controllers/expRatingController.php in Exponent CMS 2.4.0 allow remote authenticated users to execute arbitrary SQL commands via the 1 contenttype or 2 subtype parameter...

CVE-2016-9242

Multiple SQL injection vulnerabilities in the update method in framework/modules/core/controllers/expRatingController.php in Exponent CMS 2.4.0 allow remote authenticated users to execute arbitrary SQL commands via the 1 contenttype or 2 subtype parameter...

Sql injection

Multiple SQL injection vulnerabilities in the update method in framework/modules/core/controllers/expRatingController.php in Exponent CMS 2.4.0 allow remote authenticated users to execute arbitrary SQL commands via the 1 contenttype or 2 subtype parameter...

CVE-2016-9242

Multiple SQL injection vulnerabilities in the update method in framework/modules/core/controllers/expRatingController.php in Exponent CMS 2.4.0 allow remote authenticated users to execute arbitrary SQL commands via the 1 contenttype or 2 subtype parameter...