CVE-2016-9183

The CVE-2016-9183 entry concerns Exponent CMS 2.4.0, where /framework/modules/ecommerce/controllers/orderController.php passes untrusted input to selectObjectsBySql in the mysqli_database class. The injectProof filter intended to prevent SQL injection can be bypassed, depending on the presence of...