PT-2017-9930

Name of the Vulnerable Software and Affected Versions Exponent CMS versions 2.3.9 and earlier Description The issue allows remote attackers to execute arbitrary SQL commands. This is achieved via the version parameter in the helpController.php file, which is part of the Exponent CMS framework...

PT-2017-9339

Name of the Vulnerable Software and Affected Versions Exponent CMS versions 2.3.9 and earlier Description The issue allows remote attackers to execute arbitrary SQL commands. This is achieved via the src parameter in the framework/core/models/expConfig.php file. Recommendations For Exponent CMS...

PT-2017-9338

Name of the Vulnerable Software and Affected Versions Exponent CMS versions 2.3.9 and earlier Description The issue allows remote attackers to execute arbitrary SQL commands. This is achieved via the author parameter in the blogController.php file, which is part of the...

PT-2017-9340

Name of the Vulnerable Software and Affected Versions Exponent CMS versions 2.3.9 and earlier Description The issue allows remote attackers to execute arbitrary SQL commands via the title parameter. This can lead to unauthorized access and manipulation of database content. Recommendations For...

PT-2017-9944

Name of the Vulnerable Software and Affected Versions Exponent CMS versions 2.3.9 and earlier Description The issue allows remote attackers to execute arbitrary SQL commands. This is achieved via the fileid parameter in the /framework/modules/filedownloads/controllers/filedownloadController.php...

PT-2017-9343

Name of the Vulnerable Software and Affected Versions Exponent CMS versions 2.3.9 and earlier Description The issue allows remote attackers to execute arbitrary SQL commands via the username parameter in the user.php file of the Exponent CMS framework. Recommendations For Exponent CMS versions...

PT-2017-9337

Name of the Vulnerable Software and Affected Versions Exponent CMS versions 2.3.9 and earlier Description The issue allows remote attackers to execute arbitrary SQL commands. This is achieved via the version parameter in the cron/find help.php file. Recommendations For Exponent CMS versions 2.3.9...

CVE-2016-9020: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in framework/modules/help/controllers/helpController.php in Exponent CMS 2.3.9 and earlier allows remote attackers to execute arbitrary SQL commands via the version parameter...

CVE-2016-9019: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in the activateaddress function in framework/modules/addressbook/controllers/addressController.php in Exponent CMS 2.3.9 and earlier allows remote attackers to execute arbitrary SQL commands via the iswhat parameter...

CVE-2016-7789: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in framework/core/models/expConfig.php in Exponent CMS 2.3.9 and earlier allows remote attackers to execute arbitrary SQL commands via the apikey parameter...

CVE-2016-7788: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in framework/modules/users/models/user.php in Exponent CMS 2.3.9 and earlier allows remote attackers to execute arbitrary SQL commands via the username parameter...

CVE-2016-9087: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in framework/modules/filedownloads/controllers/filedownloadController.php in Exponent CMS 2.3.9 and earlier allows remote attackers to execute arbitrary SQL commands via the fileid parameter...

CVE-2016-7783: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in framework/core/models/expRecord.php in Exponent CMS 2.3.9 and earlier allows remote attackers to execute arbitrary SQL commands via the title parameter...

CVE-2016-7782: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in framework/core/models/expConfig.php in Exponent CMS 2.3.9 and earlier allows remote attackers to execute arbitrary SQL commands via the src parameter...

CVE-2016-7781: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in framework/modules/blog/controllers/blogController.php in Exponent CMS 2.3.9 and earlier allows remote attackers to execute arbitrary SQL commands via the author parameter...

CVE-2016-7780: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in cron/findhelp.php in Exponent CMS 2.3.9 and earlier allows remote attackers to execute arbitrary SQL commands via the version parameter...

OIC Exponent CMS Remote Code Execution Vulnerability (CNVD-2017-01760)

Exponent CMS is an open source content management system based on PHP, MySQL and Exponent Framework. A remote code execution vulnerability exists in the /install/index.php page of Exponent CMS, which can be exploited by an attacker to execute arbitrary code in an affected application environment....

Code injection

install/index.php in Exponent CMS 2.3.9 allows remote attackers to execute arbitrary commands via shell metacharacters in the sc array parameter...

CVE-2016-7565

install/index.php in Exponent CMS 2.3.9 allows remote attackers to execute arbitrary commands via shell metacharacters in the sc array parameter...

CVE-2016-7565

install/index.php in Exponent CMS 2.3.9 allows remote attackers to execute arbitrary commands via shell metacharacters in the sc array parameter...