CVE-2016-7400

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

Multiple SQL injection vulnerabilities in Exponent CMS before 2.4.0 allow remote attackers to execute arbitrary SQL commands via the (1) id parameter in an activate_address address controller action, (2) title parameter in a show blog controller action, or (3) content_id parameter in a showComments expComment controller action.

Metrics

CVSS 3.0 9.8/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-89

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://www.openwall.com/lists/oss-security/2016/09/18/10Mailing List, Third Party Advisory
http://www.openwall.com/lists/oss-security/2016/09/18/2Mailing List, Third Party Advisory
http://www.securityfocus.com/bid/93041Third Party Advisory, VDB Entry
https://exponentcms.lighthouseapp.com/projects/61783/changesets/e916702a91a6342bbab483a2be2ba2f11dca3aa3Patch, Vendor Advisory
https://github.com/exponentcms/exponent-cms/commit/e916702a91a6342bbab483a2be2ba2f11dca3aa3Issue Tracking, Patch, Third Party Advisory
https://github.com/exponentcms/exponent-cms/releases/tag/v2.4.0
https://www.exploit-db.com/exploits/40412/
http://www.openwall.com/lists/oss-security/2016/09/18/10Mailing List, Third Party Advisory
http://www.openwall.com/lists/oss-security/2016/09/18/2Mailing List, Third Party Advisory
http://www.securityfocus.com/bid/93041Third Party Advisory, VDB Entry
https://exponentcms.lighthouseapp.com/projects/61783/changesets/e916702a91a6342bbab483a2be2ba2f11dca3aa3Patch, Vendor Advisory
https://github.com/exponentcms/exponent-cms/commit/e916702a91a6342bbab483a2be2ba2f11dca3aa3Issue Tracking, Patch, Third Party Advisory
https://github.com/exponentcms/exponent-cms/releases/tag/v2.4.0
https://www.exploit-db.com/exploits/40412/

Timeline

Published: Feb 7, 2017
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2016

CVE-2016-74017.5The cookie parsing code in Django before 1.8.15 and 1.9.x before 1.9.10, when used on a site with Google Analytics, allows remote attackers CVE-2016-74029.8SAP ASE 16.0 SP02 PL03 and prior versions allow attackers who own SourceDB and TargetDB databases to elevate privileges to sa (system admini CVE-2016-74049.8OpenStack Magnum passes OpenStack credentials into the Heat templates creating its instances. While these should just be used for retrieving CVE-2016-74059.8The qstr method in the PDO driver in the ADOdb Library for PHP before 5.x before 5.20.7 might allow remote attackers to conduct SQL injectio CVE-2016-74069.8Format string vulnerability in Dropbear SSH before 2016.74 allows remote attackers to execute arbitrary code via format string specifiers in CVE-2016-74079.8The dropbearconvert command in Dropbear SSH before 2016.74 allows attackers to execute arbitrary code via a crafted OpenSSH key file.CVE-2016-74088.8The dbclient in Dropbear SSH before 2016.74 allows remote attackers to execute arbitrary code via a crafted (1) -m or (2) -c argument.CVE-2016-74095.5The dbclient and server in Dropbear SSH before 2016.74, when compiled with DEBUG_TRACE, allows local users to read process memory via the -v CVE-2016-74105.5The _dwarf_read_loc_section function in dwarf_loc.c in libdwarf 20160613 allows attackers to cause a denial of service (buffer over-read) vi CVE-2016-74119.8ext/standard/var_unserializer.re in PHP before 5.6.26 mishandles object-deserialization failures, which allows remote attackers to cause a d CVE-2016-74128.1ext/mysqlnd/mysqlnd_wireprotocol.c in PHP before 5.6.26 and 7.x before 7.0.11 does not verify that a BIT field has the UNSIGNED_FLAG flag, w CVE-2016-74139.8Use-after-free vulnerability in the wddx_stack_destroy function in ext/wddx/wddx.c in PHP before 5.6.26 and 7.x before 7.0.11 allows remote