CVE-2016-7789
CriticalSummary
CVE-2016-7789 is a SQL injection vulnerability in expConfig.php in Exponent CMS version 2.3.9 and earlier. It allows remote attackers to execute arbitrary SQL commands via the apikey parameter.
Risk Assessment
Attackers can exploit this vulnerability to gain access to the database, potentially leading to data theft or system compromise. This risk can significantly impact the organization's security.
Recommendation
It is recommended to update Exponent CMS to the latest version to eliminate this vulnerability. Additionally, implementing input validation mechanisms can help minimize the risk of SQL injection attacks.
Other vulnerabilities in Exponent CMS 2.3.9 i wcześniejsze
See all- CVE-2016-9087Critical
Exponent CMS versions 2.3.9 and earlier have an SQL injection vulnerability in filedownloadController.php. This allows remote attackers to execute arbitrary SQL commands via the fileid parameter.
- CVE-2016-9020Critical
CVE-2016-9020 is a SQL injection vulnerability in helpController.php in Exponent CMS version 2.3.9 and earlier. It allows remote attackers to execute arbitrary SQL commands via the version parameter.
- CVE-2016-9019Critical
CVE-2016-9019 is an SQL injection vulnerability in the activate_address function in addressController.php in Exponent CMS version 2.3.9 and earlier. It allows remote attackers to execute arbitrary SQL commands via the is_what parameter.
- CVE-2016-7788Critical
Exponent CMS versions 2.3.9 and earlier have an SQL injection vulnerability in framework/modules/users/models/user.php that allows remote attackers to execute arbitrary SQL commands via the username parameter.
- CVE-2016-7784Critical
CVE-2016-7784 is an SQL injection vulnerability in the getSection function in expRouter.php in Exponent CMS version 2.3.9 and earlier. It allows remote attackers to execute arbitrary SQL commands via the section parameter.
- CVE-2016-7782Critical
CVE-2016-7782 is an SQL injection vulnerability in expConfig.php in Exponent CMS version 2.3.9 and earlier. It allows remote attackers to execute arbitrary SQL commands via the src parameter.
- CVE-2016-7781Critical
Exponent CMS versions 2.3.9 and earlier have an SQL injection vulnerability in blogController.php. This allows remote attackers to execute arbitrary SQL commands via the 'author' parameter.
Original NVD description (English source)
SQL injection vulnerability in framework/core/models/expConfig.php in Exponent CMS 2.3.9 and earlier allows remote attackers to execute arbitrary SQL commands via the apikey parameter.