Sql injection

In /framework/modules/ecommerce/controllers/orderController.php of Exponent CMS 2.4.0, untrusted input is passed into selectObjectsBySql. The method selectObjectsBySql of class mysqlidatabase uses the injectProof method to prevent SQL injection, but this filter can be bypassed easily: it only...

PT-2016-7683

Name of the Vulnerable Software and Affected Versions Exponent CMS version 2.4.0 Description The issue concerns the passing of untrusted input into the selectObjectsBySql method in the orderController.php file of the Exponent CMS. This method, part of the mysqli database class, attempts to preven...