CVE-2016-9184

In /framework/modules/core/controllers/expHTMLEditorController.php of Exponent CMS 2.4.0, untrusted input is used to construct a table name, and in the selectObject method in mysqli class, table names are wrapped with a character that common filters do not filter, allowing for SQL Injection. Impa...

PT-2016-7684

Name of the Vulnerable Software and Affected Versions Exponent CMS version 2.4.0 Description The issue allows for SQL Injection due to the use of untrusted input in constructing a table name in the expHTMLEditorController.php file. This is further exploited by the selectObject method in the mysql...

CVE-2016-9184: Improper Neutralization of Special Elements used in an SQL Command

In /framework/modules/core/controllers/expHTMLEditorController.php of Exponent CMS 2.4.0, untrusted input is used to construct a table name, and in the selectObject method in mysqli class, table names are wrapped with a character that common filters do not filter, allowing for SQL Injection. Impa...