What’s Vulnerable › Vulnerabilities

CVE-2016-9183

• Severity: high (CVSS 7.5 v3.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.8% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2016-11-04 · updated 2026-06-17
• Weakness: CWE-200

Description

In /framework/modules/ecommerce/controllers/orderController.php of Exponent CMS 2.4.0, untrusted input is passed into selectObjectsBySql. The method selectObjectsBySql of class mysqli_database uses the injectProof method to prevent SQL injection, but this filter can be bypassed easily: it only sanitizes user input if there are odd numbers of ' or " characters. Impact is Information Disclosure.

Affected products

• Exponent CMS: 2.4.0

References

• http://www.securityfocus.com/bid/94227
• https://github.com/exponentcms/exponent-cms/commit/3b3557e9f6ba193a4c23c8ce5498fa285dddf3f3
• http://www.securityfocus.com/bid/94227
• https://github.com/exponentcms/exponent-cms/commit/3b3557e9f6ba193a4c23c8ce5498fa285dddf3f3

Get alerted when CVE-2016-9183 or the next vulnerability affects your stack