CVE-2016-9019 | BDVDB-2026-82371 Detail

Description#

SQL injection vulnerability in the activate_address function in framework/modules/addressbook/controllers/addressController.php in Exponent CMS 2.3.9 and earlier allows remote attackers to execute arbitrary SQL commands via the is_what parameter.

Impact#

No impact statement in the source data.

Weaknesses#

No weakness recorded in the source data.

References#

http://packetstormsecurity.com/files/139484/Exponent-CMS-2.3.9-SQL-Injection.html
http://seclists.org/fulldisclosure/2016/Nov/12
http://www.securityfocus.com/bid/97240
http://forums.exponentcms.org/index.php?p=/discussion/comment/1591#Comment_1591

Exploit#

No public exploit known

History#

Version 12017-03-07Record published in the CVE List.
Version 22024-08-06Most recent update recorded in the CVE List.