2 matches found
Sql injection
In /framework/modules/ecommerce/controllers/orderController.php of Exponent CMS 2.4.0, untrusted input is passed into selectObjectsBySql. The method selectObjectsBySql of class mysqlidatabase uses the injectProof method to prevent SQL injection, but this filter can be bypassed easily: it only...
5CVSS7.7AI score0.01827EPSS
SaveExploits0References2Affected Software1
CVE-2016-9183: Exposure of Sensitive Information to an Unauthorized Actor
In /framework/modules/ecommerce/controllers/orderController.php of Exponent CMS 2.4.0, untrusted input is passed into selectObjectsBySql. The method selectObjectsBySql of class mysqlidatabase uses the injectProof method to prevent SQL injection, but this filter can be bypassed easily: it only...
7.5CVSS5.8AI score0.01827EPSS
SaveExploits0References2
20