CVE-2016-9134

Exponent CMS version 2.4.0 has an SQL Injection vulnerability in framework/core/subsystems/expRouter.php. This allows remote attackers to read database information via a specific URL.

Exponent CMS version 2.4.0 has an SQL Injection vulnerability in searchController.php, allowing remote attackers to read database information via the search_string parameter.

Exponent CMS 2.4.0 has multiple SQL injection vulnerabilities in the update method in expRatingController.php. This allows remote authenticated users to execute arbitrary SQL commands via the content_type or subtype parameters.

In Exponent CMS version 2.4.0, in the file /framework/modules/core/controllers/expHTMLEditorController.php, untrusted input is used to construct a table name, leading to SQL Injection vulnerability.

In Exponent CMS 2.4.0 in the file /framework/modules/ecommerce/controllers/orderController.php, untrusted input is passed into the selectObjectsBySql method. This method uses the injectProof method to prevent SQL injection, but this filter can be easily bypassed, leading to information disclosure.

Exponent CMS 2.4 uses PHP reflection to call methods of a controller class, leading to issues with user permission verification. Due to case insensitivity in method names, an attacker can bypass permission checks by using appropriately capitalized method names.

Exponent CMS version 2.3.9 suffers from a SQL injection vulnerability in '/framework/modules/help/controllers/helpController.php' affecting the version parameter. The impact is Information Disclosure.

CVE-2013-3295 in Exponent CMS before version 2.2.0 RC1 has a directory traversal vulnerability. It allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the page parameter.

Exponent CMS versions 2.4.1 and earlier have an SQL injection vulnerability via a base64 serialized API key (apikey parameter) in the api function of framework/modules/eaas/controllers/eaasController.php.

In Exponent CMS version 2.3.9, the install/index.php file allows remote attackers to execute arbitrary commands via shell metacharacters in the sc array parameter.