CVE-2016-7790

Critical

Published: 12/01/2017(UTC)Translated: 14/06/2026(UTC)NVD NIST

Summary

Exponent CMS version 2.3.9 suffers from a remote code execution vulnerability in /install/index.php. An attacker can upload a 'php' file to the website through uploader_paste.php, then overwrite /framework/conf/config.php, leading to arbitrary code execution.

Risk Assessment

This vulnerability allows an attacker to execute code remotely, potentially leading to full system compromise. The organization is at risk of data loss and unauthorized access to resources.

Recommendation

It is recommended to update Exponent CMS to the latest version to mitigate this vulnerability. Additionally, access to configuration files should be restricted and uploaded files should be monitored.

Original NVD description (English source)

Exponent CMS 2.3.9 suffers from a remote code execution vulnerability in /install/index.php. An attacker can upload 'php' file to the website through uploader_paste.php, then overwrite /framework/conf/config.php, which leads to arbitrary code execution.