PT-2014-2674 · Exponent · Exponent Cms

Publicado 2014-02-11 · Atualizado 2017-08-29 · CVE-2013-3294

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Exponent CMS versions prior to 2.2.0 release candidate 1

Description The issue allows remote attackers to execute arbitrary SQL commands. This can be achieved via the src or username parameter to the "index.php" endpoint.

Recommendations For versions prior to 2.2.0 release candidate 1, update to version 2.2.0 release candidate 1 or later to resolve the issue.

Exploit

Correção

RCE

SQL injection

Enumeração de Fraquezas

CWE-89

Identificadores relacionados

CVE-2013-3294

Produtos afetados

Exponent Cms

Referências · 8

• 🔥 https://exploit-db.com/exploits/25518 · Exploit
• http://packetstormsecurity.com/files/121643/Exponent-CMS-2.2.0-Beta-3-LFI-SQL-Injection.html · Nota
• http://seclists.org/bugtraq/2013/May/57 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/84300 · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-3294 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2013-3294 · Nota de Segurança
• http://osvdb.org/93447 · Nota
• https://htbridge.com/advisory/HTB23154 · Nota