CVE-2017-5879
CriticalSummary
An issue was discovered in Exponent CMS 2.4.1 related to blind SQL injection that can be exploited by unauthenticated users via an HTTP GET request. This vulnerability allows for dumping database data to a malicious server.
Risk Assessment
This vulnerability poses a serious risk to the organization's data security, allowing attackers to access sensitive information in the database.
Recommendation
It is recommended to update Exponent CMS to the latest version and implement appropriate security measures to minimize the risk of SQL injection attacks.
Original NVD description (English source)
An issue was discovered in Exponent CMS 2.4.1. This is a blind SQL injection that can be exploited by un-authenticated users via an HTTP GET request and which can be used to dump database data out to a malicious server, using an out-of-band technique, such as select_loadfile(). The vulnerability affects source_selector.php and the following parameter: src.