cbcvebase.
CVE-2016-7400
published 2017-02-07

CVE-2016-7400: Multiple SQL injection vulnerabilities in Exponent CMS before 2.4.0 allow remote attackers to execute arbitrary SQL commands via the (1) id parameter in an…

PriorityP266critical9.8CVSS 3.0
AVNACLPRNUINSUCHIHAH
EXPLOIT
EPSS
4.65%
90.6th percentile
Multiple SQL injection vulnerabilities in Exponent CMS before 2.4.0 allow remote attackers to execute arbitrary SQL commands via the (1) id parameter in an activate_address address controller action, (2) title parameter in a show blog controller action, or (3) content_id parameter in a showComments expComment controller action.

Affected

1 ranges
VendorProductVersion rangeFixed in
exponentcmsexponent_cms<= 2.3.9—

Detection & IOCsextracted from sources · hover to see the quote

url/exponent/index.php'%20or%201%3d1--%20↗
url/exponent/index.php'%20or%201%3d2--%20↗
url/exponent/index.php'%20OR%20SLEEP(1)--%20↗
url/exponent/index.php'%20OR%20SLEEP(30)--%20↗
path/exponent/index.php↗
  • →Monitor HTTP requests to /exponent/index.php containing SQL injection patterns such as OR SLEEP(), boolean-based payloads (or 1=1, or 1=2), or URL-encoded equivalents (%20OR%20SLEEP, %20or%201%3d1). ↗
  • →Detect time-based blind SQLi by alerting on anomalously delayed responses (≥2s) to requests targeting /exponent/index.php, consistent with SLEEP() injection. ↗
  • →Flag injection attempts via the 'id' parameter in activate_address address controller, 'title' parameter in show blog controller, and 'content_id' parameter in showComments expComment controller actions. ↗
  • →The exploit requires HTTP/1.0 protocol version; consider alerting on HTTP/1.0 requests targeting Exponent CMS endpoints as a low-signal supplementary indicator. ↗
  • ·Vulnerability affects Exponent CMS versions up to and including 2.3.9; version 2.4.0 and later contain the vendor fix. ↗
  • ·The exploit was confirmed against the index.php entry point; other vulnerable parameters (id, title, content_id) are reached via specific controller actions and may require different request structures. ↗

CVSS provenance

nvdv3.09.8CRITICALCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv2.07.5HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P
CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.