PT-2014-2674 · Exponent · Exponent Cms

Published 2014-02-11 · Updated 2017-08-29 · CVE-2013-3294

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Exponent CMS versions prior to 2.2.0 release candidate 1

Description The issue allows remote attackers to execute arbitrary SQL commands. This can be achieved via the src or username parameter to the "index.php" endpoint.

Recommendations For versions prior to 2.2.0 release candidate 1, update to version 2.2.0 release candidate 1 or later to resolve the issue.

Exploit

Fix

RCE

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2013-3294

Affected Products

Exponent Cms

References · 8

• 🔥 https://exploit-db.com/exploits/25518 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2013-3294 · Security Note
• http://packetstormsecurity.com/files/121643/Exponent-CMS-2.2.0-Beta-3-LFI-SQL-Injection.html · Note
• http://seclists.org/bugtraq/2013/May/57 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/84300 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-3294 · Note
• http://osvdb.org/93447 · Note
• https://htbridge.com/advisory/HTB23154 · Note