CVE-2016-9135
HighSummary
Exponent CMS version 2.3.9 suffers from a SQL injection vulnerability in '/framework/modules/help/controllers/helpController.php' affecting the version parameter. The impact is Information Disclosure.
Risk Assessment
This vulnerability may lead to the disclosure of sensitive information, posing a threat to the organization's data security.
Recommendation
It is recommended to update Exponent CMS to the latest version to mitigate this vulnerability and conduct a security audit of the application.
Other vulnerabilities in Exponent CMS 2.3.9
See all- CVE-2016-9283High
Exponent CMS version 2.4.0 has an SQL Injection vulnerability in framework/core/subsystems/expRouter.php. This allows remote attackers to read database information via a specific URL.
- CVE-2016-9282High
Exponent CMS version 2.4.0 has an SQL Injection vulnerability in searchController.php, allowing remote attackers to read database information via the search_string parameter.
- CVE-2016-9242High
Exponent CMS 2.4.0 has multiple SQL injection vulnerabilities in the update method in expRatingController.php. This allows remote authenticated users to execute arbitrary SQL commands via the content_type or subtype parameters.
- CVE-2016-9184High
In Exponent CMS version 2.4.0, in the file /framework/modules/core/controllers/expHTMLEditorController.php, untrusted input is used to construct a table name, leading to SQL Injection vulnerability.
- CVE-2016-9183High
In Exponent CMS 2.4.0 in the file /framework/modules/ecommerce/controllers/orderController.php, untrusted input is passed into the selectObjectsBySql method. This method uses the injectProof method to prevent SQL injection, but this filter can be easily bypassed, leading to information disclosure.
- CVE-2016-9182High
Exponent CMS 2.4 uses PHP reflection to call methods of a controller class, leading to issues with user permission verification. Due to case insensitivity in method names, an attacker can bypass permission checks by using appropriately capitalized method names.
- CVE-2016-9134High
Exponent CMS version 2.3.9 suffers from a SQL injection vulnerability in '/expPaginator.php' affecting the 'order' parameter.
- CVE-2013-3295High
CVE-2013-3295 in Exponent CMS before version 2.2.0 RC1 has a directory traversal vulnerability. It allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the page parameter.
- CVE-2017-7991Critical
Exponent CMS versions 2.4.1 and earlier have an SQL injection vulnerability via a base64 serialized API key (apikey parameter) in the api function of framework/modules/eaas/controllers/eaasController.php.
- CVE-2016-7565Critical
In Exponent CMS version 2.3.9, the install/index.php file allows remote attackers to execute arbitrary commands via shell metacharacters in the sc array parameter.
Original NVD description (English source)
Exponent CMS 2.3.9 suffers from a SQL injection vulnerability in "/framework/modules/help/controllers/helpController.php" affecting the version parameter. Impact is Information Disclosure.