CVE-2016-7781

SQL injection vulnerability in framework/modules/blog/controllers/blogController.php in Exponent CMS 2.3.9 and earlier allows remote attackers to execute arbitrary SQL commands via the author parameter...

CVE-2016-7781

Exponent CMS prior to 2.4.0 is affected by a SQL injection in the blog module: in blogController.php the author parameter is used unsafely. Root cause: $this->params['author'] is not escaped, enabling time-based blind SQL injection. A fix is available in the repository commit fdafb5ec97838e4ed...

Exponent CMS 2.3.9 SQL Injection Vulnerability

Exploit for php platform in category web applications Exponent CMS 2.3.9 SQL Injection Vulnerability Disclose 10 cve in Exponent CMS CVE-2016-7780 In the line 42 of cron/findhelp.php , $GET'version' can be controlled and injected. It is possible to time-based blind SQL Inject by the param of...