high7.5Public exploit code
CVE-2013-3294
Multiple SQL injection vulnerabilities in Exponent CMS before 2.2.0 release candidate 1 allow remote attackers to execute arbitrary SQL commands via the (1) sr…
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- Exponent CMS 2.2.0 Beta 3 - Multiple Vulnerabilities2013-05-17 · webapps · php
Impact
Multiple SQL injection vulnerabilities in Exponent CMS before 2.2.0 release candidate 1 allow remote attackers to execute arbitrary SQL commands via the (1) src or (2) username parameter to index.php.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Exponentcms | Exponent Cms | through 2.2.0 Versions 0.97.0, 0.98.0, 0.99.0, 2.0.0, 2.0.1 |
Weakness classification
References
- NVD record
- CVE.org record
- http://osvdb.org/93447
- http://packetstormsecurity.com/files/121643/Exponent-CMS-2.2.0-Beta-3-LFI-SQL-Injection.html
- http://seclists.org/bugtraq/2013/May/57
- https://exchange.xforce.ibmcloud.com/vulnerabilities/84300
- https://www.htbridge.com/advisory/HTB23154
- http://osvdb.org/93447
- http://packetstormsecurity.com/files/121643/Exponent-CMS-2.2.0-Beta-3-LFI-SQL-Injection.html
- http://seclists.org/bugtraq/2013/May/57
- https://exchange.xforce.ibmcloud.com/vulnerabilities/84300
- https://www.htbridge.com/advisory/HTB23154