Exponent CMS vulnerabilities

Exponent CMS version 2.4.0 has an SQL Injection vulnerability in framework/core/subsystems/expRouter.php. This allows remote attackers to read database information via a specific URL.

Exponent CMS version 2.4.0 has an SQL Injection vulnerability in searchController.php, allowing remote attackers to read database information via the search_string parameter.

Exponent CMS 2.4.0 has multiple SQL injection vulnerabilities in the update method in expRatingController.php. This allows remote authenticated users to execute arbitrary SQL commands via the content_type or subtype parameters.

In Exponent CMS version 2.4.0, in the file /framework/modules/core/controllers/expHTMLEditorController.php, untrusted input is used to construct a table name, leading to SQL Injection vulnerability.

In Exponent CMS 2.4.0 in the file /framework/modules/ecommerce/controllers/orderController.php, untrusted input is passed into the selectObjectsBySql method. This method uses the injectProof method to prevent SQL injection, but this filter can be easily bypassed, leading to information disclosure.

Exponent CMS 2.4 uses PHP reflection to call methods of a controller class, leading to issues with user permission verification. Due to case insensitivity in method names, an attacker can bypass permission checks by using appropriately capitalized method names.

Exponent CMS version 2.3.9 suffers from a SQL injection vulnerability in '/framework/modules/help/controllers/helpController.php' affecting the version parameter. The impact is Information Disclosure.

Exponent CMS version 2.3.9 suffers from a SQL injection vulnerability in '/expPaginator.php' affecting the 'order' parameter.

CVE-2013-3295 in Exponent CMS before version 2.2.0 RC1 has a directory traversal vulnerability. It allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the page parameter.

Exponent CMS versions 2.4.1 and earlier have an SQL injection vulnerability via a base64 serialized API key (apikey parameter) in the api function of framework/modules/eaas/controllers/eaasController.php.

In Exponent CMS version 2.3.9, the install/index.php file allows remote attackers to execute arbitrary commands via shell metacharacters in the sc array parameter.

Multiple SQL injection vulnerabilities in Exponent CMS before version 2.4.0 allow remote attackers to execute arbitrary SQL commands through various parameters such as id, title, and content_id.

Exponent CMS 2.x before 2.3.7 Patch 3 allows remote attackers to execute arbitrary code via the sc parameter to install/index.php.

Exponent CMS version 2.3.9 has a remote code execution vulnerability in /install/index.php. An attacker can upload a malicious 'exploit.tar.gz' file to the website and then extract it, leading to arbitrary code execution.

Exponent CMS version 2.3.9 suffers from a remote code execution vulnerability in /install/index.php. An attacker can upload a 'php' file to the website through uploader_paste.php, then overwrite /framework/conf/config.php, leading to arbitrary code execution.

In Exponent CMS version 2.4.0, there is a SQL injection vulnerability in the showComments method in expCommentController.php. The content_id parameter is used directly in the SQL query, allowing an attacker to manipulate data.

A Blind SQL Injection Vulnerability in Exponent CMS through 2.4.0, with the rerank array parameter, can lead to site database information disclosure and denial of service.

Exponent CMS versions before 2.3.9 are vulnerable to an attacker uploading a malicious script file via redirection, allowing the script to be placed in an unprotected folder that permits script execution.

Exponent CMS 2.6 contains a stored XSS vulnerability that allows authenticated attackers to inject malicious scripts via the Title and Text Block parameters in the text editing endpoint. Attackers can inject iframe payloads with embedded SVG onload events to execute arbitrary JavaScript. The application also exposes database credentials in responses and lacks brute-force protection on authentication endpoints.