CVE-2016-9481

Critical

Published: 29/11/2016(UTC)Translated: 14/06/2026(UTC)NVD NIST

Summary

In Exponent CMS version 2.4.0, there is a SQL injection vulnerability in the showComments method in expCommentController.php. The content_id parameter is used directly in the SQL query, allowing an attacker to manipulate data.

Risk Assessment

This vulnerability could lead to unauthorized access to the database and exposure of sensitive information. Organizations should be aware of the risks associated with potential data leaks.

Recommendation

It is recommended to update Exponent CMS to the latest version to eliminate this vulnerability. Additionally, implementing proper security measures such as prepared SQL statements is advisable.

Original NVD description (English source)

In framework/modules/core/controllers/expCommentController.php of Exponent CMS 2.4.0, content_id input is passed into showComments. The method showComments is defined in the expCommentControllercontroller with the parameter '$this->params['content_id']' used directly in SQL. Impact is a SQL injection.