Vulnerability Description
Multiple SQL injection vulnerabilities in Exponent CMS before 2.4.0 allow remote attackers to execute arbitrary SQL commands via the (1) id parameter in an activate_address address controller action, (2) title parameter in a show blog controller action, or (3) content_id parameter in a showComments expComment controller action.
CVSS Score
CRITICAL
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Exponentcms | Exponent Cms | <= 2.3.9 |
Related Weaknesses (CWE)
References
- http://www.openwall.com/lists/oss-security/2016/09/18/10Mailing ListThird Party Advisory
- http://www.openwall.com/lists/oss-security/2016/09/18/2Mailing ListThird Party Advisory
- http://www.securityfocus.com/bid/93041Third Party AdvisoryVDB Entry
- https://exponentcms.lighthouseapp.com/projects/61783/changesets/e916702a91a6342bPatchVendor Advisory
- https://github.com/exponentcms/exponent-cms/commit/e916702a91a6342bbab483a2be2baIssue TrackingPatchThird Party Advisory
- https://github.com/exponentcms/exponent-cms/releases/tag/v2.4.0
- https://www.exploit-db.com/exploits/40412/
- http://www.openwall.com/lists/oss-security/2016/09/18/10Mailing ListThird Party Advisory
- http://www.openwall.com/lists/oss-security/2016/09/18/2Mailing ListThird Party Advisory
- http://www.securityfocus.com/bid/93041Third Party AdvisoryVDB Entry
- https://exponentcms.lighthouseapp.com/projects/61783/changesets/e916702a91a6342bPatchVendor Advisory
- https://github.com/exponentcms/exponent-cms/commit/e916702a91a6342bbab483a2be2baIssue TrackingPatchThird Party Advisory
- https://github.com/exponentcms/exponent-cms/releases/tag/v2.4.0
- https://www.exploit-db.com/exploits/40412/
FAQ
What is CVE-2016-7400?
CVE-2016-7400 is a vulnerability with a CVSS score of 9.8 (CRITICAL). Multiple SQL injection vulnerabilities in Exponent CMS before 2.4.0 allow remote attackers to execute arbitrary SQL commands via the (1) id parameter in an activate_address address controller action, ...
How severe is CVE-2016-7400?
CVE-2016-7400 has been rated CRITICAL with a CVSS base score of 9.8/10. This is considered a critical vulnerability requiring immediate attention.
Is there a patch for CVE-2016-7400?
Check the references section above for vendor advisories and patch information. Affected products include: Exponentcms Exponent Cms.