CVE-2013-3294

Exponent CMS <2.2.0 - SQL Injection

Title source: llm
STIX 2.1

Description

Multiple SQL injection vulnerabilities in Exponent CMS before 2.2.0 release candidate 1 allow remote attackers to execute arbitrary SQL commands via the (1) src or (2) username parameter to index.php.

Exploits (1)

exploitdb WORKING POC
by High-Tech Bridge SA · textwebappsphp
https://www.exploit-db.com/exploits/25518

References (5)

Core 5
Core References
Vendor Advisory x_refsource_misc
https://www.htbridge.com/advisory/HTB23154
Third Party Advisory, VDB Entry vdb-entry x_refsource_osvdb
http://osvdb.org/93447
Mailing List mailing-list x_refsource_bugtraq
http://seclists.org/bugtraq/2013/May/57
Third Party Advisory, VDB Entry vdb-entry x_refsource_xf
https://exchange.xforce.ibmcloud.com/vulnerabilities/84300

Scores

EPSS 0.0062
EPSS Percentile 70.0%

Details

CWE
CWE-89
Status published
Products (19)
exponentcms/exponent_cms 0.97.0
exponentcms/exponent_cms 0.98.0
exponentcms/exponent_cms 0.99.0 beta1
exponentcms/exponent_cms 2.0.0
exponentcms/exponent_cms 2.0.1
exponentcms/exponent_cms 2.0.2
exponentcms/exponent_cms 2.0.3
exponentcms/exponent_cms 2.0.4
exponentcms/exponent_cms 2.0.5
exponentcms/exponent_cms 2.0.6
... and 9 more
Published Feb 11, 2014
Tracked Since Feb 18, 2026