CVE-2016-9287
CriticalSummary
In Exponent CMS 2.4.0 patch1, untrusted input is passed into the getSearchResults method in notfoundController.php. This method uses the '$term' parameter directly in SQL, leading to a SQL injection vulnerability.
Risk Assessment
An attacker could exploit this vulnerability to execute unauthorized SQL queries, potentially leading to data exposure or database compromise.
Recommendation
It is recommended to validate and sanitize input data before using it in SQL queries and to upgrade to the latest version of Exponent CMS to mitigate this vulnerability.
Original NVD description (English source)
In /framework/modules/notfound/controllers/notfoundController.php of Exponent CMS 2.4.0 patch1, untrusted input is passed into getSearchResults. The method getSearchResults is defined in the search model with the parameter '$term' used directly in SQL. Impact is a SQL injection.