Skip to content

CVE-2016-9287 In /framework/modules/notfound/controllers/notfoundController.php of Exponent CMS 2.4.0 patch1, untrusted input is passed into getSearchResults. The method getSearchResults is defined in the search mo...

CriticalCVSS 9.8 EPSS 1.5%
Published
Updated
Exploit status
No public exploit known
Sign in for asset impact Search another CVE

Description

In /framework/modules/notfound/controllers/notfoundController.php of Exponent CMS 2.4.0 patch1, untrusted input is passed into getSearchResults. The method getSearchResults is defined in the search model with the parameter '$term' used directly in SQL. Impact is a SQL injection.

Affected products

ProductAffected versionsFixed in
exponentcms exponent cms = 2.4.0-p1 No fix listed

References

  • 94322 third-party-advisory vdb-entry
  • github.com issue-tracking patch third-party-advisory