CVE-2017-5879
CRITICALExponent CMS 2.4.1 - Unauthenticated Blind SQL Injection via source_selector.php src Parameter
Title source: llmDescription
An issue was discovered in Exponent CMS 2.4.1. This is a blind SQL injection that can be exploited by un-authenticated users via an HTTP GET request and which can be used to dump database data out to a malicious server, using an out-of-band technique, such as select_loadfile(). The vulnerability affects source_selector.php and the following parameter: src.
References (2)
Core 2
Core References
Issue Tracking, Patch, Third Party Advisory x_refsource_misc
https://github.com/exponentcms/exponent-cms/issues/73
Third Party Advisory, VDB Entry vdb-entry
x_refsource_bid
http://www.securityfocus.com/bid/96039
Scores
CVSS v3
9.8
EPSS
0.0191
EPSS Percentile
77.6%
Attack Vector
NETWORK
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Details
CWE
CWE-89
Status
published
Products (1)
exponentcms/exponent_cms
2.4.1
Published
Feb 06, 2017
Tracked Since
Feb 18, 2026