NVD

Id
22351  
Name
CVE-2016-9287  
Description
In /framework/modules/notfound/controllers/notfoundController.php of Exponent CMS 2.4.0 patch1, untrusted input is passed into getSearchResults. The method getSearchResults is defined in the search model with the parameter "$term" used directly in SQL. Impact is a SQL injection.  
Reject
 
CVSS Version
2  
CVSS Score
7.5  
Severity
High  
CVSS Base Score
7.5  
CVSS Impact Subscore
6.4  
CVSS Exploit Subscore
10  
CVSS Vector
(AV:N/AC:L/Au:N/C:P/I:P/A:P)  
Pub Date
2017-01-19  
Published
2016-11-15  
Modified Date
2016-11-29  
Seq
2016-9287  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
118772 22351 CVE-2016-9287 94322  View
118773 22351 CVE-2016-9287 https://github.com/exponentcms/exponent-cms/commit/4327ea96b3de89440693e06d03038121aa1fdcea  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
5106 JVNDB-2016-005879 Exponent CMS の /framework/modules/notfound/controllers/notfoundController.php における SQL インジェクションの脆弱性 Exponent CMS の /framework/modules/notfound/controllers/notfoundController.php は、信頼性のない入力を getSearchResults に渡すため、SQL インジェクションの脆弱性が存在します。 CVE-2016-9287 95794 CVE-2016-9287 22351 7.5 9.8 http://jvndb.jvn.jp/ja/contents/2016/JVNDB-2016-005879.html 2016-11-06 2016-11-16 View