PT-2016-7723

Name of the Vulnerable Software and Affected Versions Exponent CMS version 2.4.0 Description The issue allows remote attackers to read user information by modifying the id number. This is related to an issue with "addresses, countries, and regions". An example of exploitation is via the endpoint...

PT-2016-7717

Name of the Vulnerable Software and Affected Versions Exponent CMS versions prior to 2.4.1 Description A Blind SQL Injection issue can lead to site database information disclosure and denial of service. The issue is related to the rerank array parameter. Recommendations For versions prior to 2.4....

PT-2016-7722

Name of the Vulnerable Software and Affected Versions Exponent CMS version 2.4.0 Description The issue allows remote attackers to read user information. This is achieved through the getUsersByJSON endpoint, specifically by appending a string to the "users/getUsersByJSON/sort/" endpoint...

PT-2016-7720

Name of the Vulnerable Software and Affected Versions Exponent CMS version 2.4.0 Description The issue allows remote attackers to read database information. This is achieved by exploiting the search string parameter in the "action=search&module=search" API endpoint. Recommendations For Exponent C...

PT-2016-7726

Name of the Vulnerable Software and Affected Versions Exponent CMS versions 2.4.0 and earlier Description The issue concerns a SQL injection problem. Specifically, the target parameter of the DragnDropReRank function in the navigationController.php file is used directly without filtration, allowi...

Exponent CMS 2.4.0 Blind SQL Injection Vulnerability

Exponent CMS version 2.4.0 suffers from a remote blind SQL injection vulnerability...

Exponent CMS 2.4.0 Blind SQL Injection

Document Title: =============== Blind SQL Injection Vulnerability in Exponent CMS 2.4.0 References Source: ==================== https://exponentcms.lighthouseapp.com/projects/61783/tickets/1394-blind-sql-injection-vulnerability-in-exponent-cms-240-4...

Exponent CMS SQL Injection Vulnerability (CNVD-2016-10804)

Exponent is a web content management system. Multiple SQL injection vulnerabilities exist in the framework/modules/core/controllers/expRatingController.php/update method in Exponent CMS version 2.4.0, which can be exploited by an authenticated remote user to execute arbitrary SQL commands via the...

CVE-2016-9242

Multiple SQL injection vulnerabilities in the update method in framework/modules/core/controllers/expRatingController.php in Exponent CMS 2.4.0 allow remote authenticated users to execute arbitrary SQL commands via the 1 contenttype or 2 subtype parameter...

CVE-2016-9242

Multiple SQL injection vulnerabilities in the update method in framework/modules/core/controllers/expRatingController.php in Exponent CMS 2.4.0 allow remote authenticated users to execute arbitrary SQL commands via the 1 contenttype or 2 subtype parameter...

Sql injection

Multiple SQL injection vulnerabilities in the update method in framework/modules/core/controllers/expRatingController.php in Exponent CMS 2.4.0 allow remote authenticated users to execute arbitrary SQL commands via the 1 contenttype or 2 subtype parameter...

CVE-2016-9242

Multiple SQL injection vulnerabilities in the update method in framework/modules/core/controllers/expRatingController.php in Exponent CMS 2.4.0 allow remote authenticated users to execute arbitrary SQL commands via the 1 contenttype or 2 subtype parameter...

CVE-2016-9242

Multiple SQL injection vulnerabilities in the update method in framework/modules/core/controllers/expRatingController.php in Exponent CMS 2.4.0 allow remote authenticated users to execute arbitrary SQL commands via the 1 contenttype or 2 subtype parameter...

CVE-2016-9242

Exponent CMS 2.4.0 is affected by multiple SQL injection vulnerabilities in the update method of framework/modules/core/controllers/expRatingController.php. The issues allow remote authenticated users to execute arbitrary SQL commands via the content_type or subtype parameters. Impact is describe...

CVE-2016-9242: Improper Neutralization of Special Elements used in an SQL Command

Multiple SQL injection vulnerabilities in the update method in framework/modules/core/controllers/expRatingController.php in Exponent CMS 2.4.0 allow remote authenticated users to execute arbitrary SQL commands via the 1 contenttype or 2 subtype parameter...

PT-2016-7714

Name of the Vulnerable Software and Affected Versions Exponent CMS version 2.4.0 Description The issue concerns SQL injection vulnerabilities in the update method within the expRatingController.php file of Exponent CMS. These vulnerabilities allow remote authenticated users to execute arbitrary S...

OIC Exponent CMS Privilege Bypass Vulnerability

OIC Exponent CMS is a free, open source modular content management system CMS based on PHP from the American OIC Group of companies. The system supports direct editing in the page, and provides user management, site configuration, content editing and other functions. A privilege bypass...

OIC Exponent CMS SQL Injection Vulnerability (CNVD-2016-10747)

OIC Exponent CMS is a free, open source modular content management system CMS based on PHP from the American OIC Group of companies. The system supports direct editing in the page, and provides user management, site configuration, content editing and other functions. An SQL injection vulnerabilit...

OIC Exponent CMS Information Disclosure Vulnerability

OIC Exponent CMS is a free, open source modular content management system CMS based on PHP from the American OIC Group of companies. The system supports direct editing in the page, and provides user management, site configuration, content editing and other functions. An information disclosure...

CVE-2016-9184

In /framework/modules/core/controllers/expHTMLEditorController.php of Exponent CMS 2.4.0, untrusted input is used to construct a table name, and in the selectObject method in mysqli class, table names are wrapped with a character that common filters do not filter, allowing for SQL Injection. Impa...