CVE-2016-7791

Critical

Published: 12/01/2017(UTC)Translated: 14/06/2026(UTC)NVD NIST

Summary

Exponent CMS version 2.3.9 has a remote code execution vulnerability in /install/index.php. An attacker can upload a malicious 'exploit.tar.gz' file to the website and then extract it, leading to arbitrary code execution.

Risk Assessment

This vulnerability allows an attacker to execute code remotely, potentially leading to full system compromise. Organizations should be aware of the risks associated with unauthorized access to their applications.

Recommendation

It is recommended to update Exponent CMS to the latest version to mitigate this vulnerability. Additionally, access to installation files on the server should be restricted.

Original NVD description (English source)

Exponent CMS 2.3.9 suffers from a remote code execution vulnerability in /install/index.php. An attacker can upload an evil 'exploit.tar.gz' file to the website, then extract it by visiting '/install/index.php?install_sample=../../files/exploit', which leads to arbitrary code execution.