CVE-2016-7400

Critical

Published: 07/02/2017(UTC)Translated: 14/06/2026(UTC)NVD NIST

Summary

Multiple SQL injection vulnerabilities in Exponent CMS before version 2.4.0 allow remote attackers to execute arbitrary SQL commands through various parameters such as id, title, and content_id.

Risk Assessment

Attackers may gain access to sensitive data or manipulate the database, potentially leading to serious security consequences for the organization.

Recommendation

It is recommended to update Exponent CMS to version 2.4.0 or later and to review and secure the application code against SQL injection vulnerabilities.

Original NVD description (English source)

Multiple SQL injection vulnerabilities in Exponent CMS before 2.4.0 allow remote attackers to execute arbitrary SQL commands via the (1) id parameter in an activate_address address controller action, (2) title parameter in a show blog controller action, or (3) content_id parameter in a showComments expComment controller action.