CVE-2021-47931
MediumCVSS 6.4Exploitation Probability (EPSS)
Low risk12th percentile - higher than 12% of all known CVEs
Summary
Exponent CMS 2.6 contains a stored XSS vulnerability that allows authenticated attackers to inject malicious scripts via the Title and Text Block parameters in the text editing endpoint. Attackers can inject iframe payloads with embedded SVG onload events to execute arbitrary JavaScript. The application also exposes database credentials in responses and lacks brute-force protection on authentication endpoints.
Risk Assessment
An attacker can steal administrator sessions, modify content, or steal database credentials, threatening system confidentiality and integrity.
Recommendation
It is recommended to update Exponent CMS to the latest version, implement input validation, and add brute-force protection.
Other vulnerabilities in Exponent CMS
See all- CVE-2016-9283High
Exponent CMS version 2.4.0 has an SQL Injection vulnerability in framework/core/subsystems/expRouter.php. This allows remote attackers to read database information via a specific URL.
- CVE-2016-9282High
Exponent CMS version 2.4.0 has an SQL Injection vulnerability in searchController.php, allowing remote attackers to read database information via the search_string parameter.
- CVE-2016-9242High
Exponent CMS 2.4.0 has multiple SQL injection vulnerabilities in the update method in expRatingController.php. This allows remote authenticated users to execute arbitrary SQL commands via the content_type or subtype parameters.
- CVE-2016-9184High
In Exponent CMS version 2.4.0, in the file /framework/modules/core/controllers/expHTMLEditorController.php, untrusted input is used to construct a table name, leading to SQL Injection vulnerability.
- CVE-2016-9183High
In Exponent CMS 2.4.0 in the file /framework/modules/ecommerce/controllers/orderController.php, untrusted input is passed into the selectObjectsBySql method. This method uses the injectProof method to prevent SQL injection, but this filter can be easily bypassed, leading to information disclosure.
- CVE-2016-9182High
Exponent CMS 2.4 uses PHP reflection to call methods of a controller class, leading to issues with user permission verification. Due to case insensitivity in method names, an attacker can bypass permission checks by using appropriately capitalized method names.
- CVE-2016-9135High
Exponent CMS version 2.3.9 suffers from a SQL injection vulnerability in '/framework/modules/help/controllers/helpController.php' affecting the version parameter. The impact is Information Disclosure.
- CVE-2016-9134High
Exponent CMS version 2.3.9 suffers from a SQL injection vulnerability in '/expPaginator.php' affecting the 'order' parameter.
- CVE-2013-3295High
CVE-2013-3295 in Exponent CMS before version 2.2.0 RC1 has a directory traversal vulnerability. It allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the page parameter.
- CVE-2017-7991Critical
Exponent CMS versions 2.4.1 and earlier have an SQL injection vulnerability via a base64 serialized API key (apikey parameter) in the api function of framework/modules/eaas/controllers/eaasController.php.
Original NVD description (English source)
Exponent CMS 2.6 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject malicious scripts through the Title and Text Block parameters in the text editing endpoint. Attackers can inject iframe payloads with embedded SVG onload events to execute arbitrary JavaScript. The application also exposes database credentials in responses and lacks brute-force protection on authentication endpoints.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS