CVE-2016-9183

In /framework/modules/ecommerce/controllers/orderController.php of Exponent CMS 2.4.0, untrusted input is passed into selectObjectsBySql

published November 4, 2016

CVSS
—
EPSS
2%
Percentile
78.7
In the wild
Unconfirmed
What it is

In /framework/modules/ecommerce/controllers/orderController.php of Exponent CMS 2.4.0, untrusted input is passed into selectObjectsBySql. The method selectObjectsBySql of class mysqli_database uses the injectProof method to prevent SQL injection, but this filter can be bypassed easily: it only sanitizes user input if there are odd numbers of ' or " characters. Impact is Information Disclosure.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.01827 · 78.7th percentile
Published
2016-11-04T10:00Z
EPSS history
Timeline
  • 04 NOV 10:00Z
    In /framework/modules/ecommerce/controllers/orderController.php of Exponent CMS 2.4.0, untrusted input is passed into selectObjectsBySql
    cvelistv5