Skip to content

CVE-2017-5879 An issue was discovered in Exponent CMS 2.4.1. This is a blind SQL injection that can be exploited by un-authenticated users via an HTTP GET request and which can be used to dump database data out to....

CriticalCVSS 9.8 EPSS 1.9%
Published
Updated
Exploit status
No public exploit known
Sign in for asset impact Search another CVE

Description

An issue was discovered in Exponent CMS 2.4.1. This is a blind SQL injection that can be exploited by un-authenticated users via an HTTP GET request and which can be used to dump database data out to a malicious server, using an out-of-band technique, such as select_loadfile(). The vulnerability affects source_selector.php and the following parameter: src.

Affected products

ProductAffected versionsFixed in
exponentcms exponent cms = 2.4.1 No fix listed

References

  • 96039 third-party-advisory vdb-entry
  • github.com issue-tracking patch third-party-advisory