CVE-2016-9481
Quick assessment
Affected
n/a n/a
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
OIC Exponent CMS是美国OIC集团公司的一套基于PHP的免费、开源的模块化内容管理系统（CMS）。该系统支持在页面中直接进行编辑，并提供用户管理、网站配置、内容编辑等功能。 OIC Exponent CMS 2.4.0版本的framework/modules/core/controllers/expCommentController.php脚本中存在安全漏洞，该漏洞源于程序没有验证‘content_id’参数。攻击者可利用该漏洞执行任意SQL命令。
Possible ATT&CK Techniques 3 AI
T1210 · Exploitation of Remote Services T1205 · Traffic Signaling T1210.001
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2016-9481
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
N/A
Source: CVE Program / CVE List V5
Vulnerability Description
In framework/modules/core/controllers/expCommentController.php of Exponent CMS 2.4.0, content_id input is passed into showComments. The method showComments is defined in the expCommentControllercontroller with the parameter '$this->params['content_id']' used directly in SQL. Impact is a SQL injection.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
OIC Exponent CMS SQL注入漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
OIC Exponent CMS是美国OIC集团公司的一套基于PHP的免费、开源的模块化内容管理系统（CMS）。该系统支持在页面中直接进行编辑，并提供用户管理、网站配置、内容编辑等功能。 OIC Exponent CMS 2.4.0版本的framework/modules/core/controllers/expCommentController.php脚本中存在安全漏洞，该漏洞源于程序没有验证‘content_id’参数。攻击者可利用该漏洞执行任意SQL命令。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| - | n/a | n/a | - |
|
II. Public POCs for CVE-2016-9481
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2016-9481
请登录查看更多情报信息。
Vendor Advisories for CVE-2016-9481 (2)
Other References for CVE-2016-9481 (1)
-
http://www.pang0lin.com/?p=1076 x_refsource_MISC
Same Patch Batch · n/a · 2016-11-29 · 6 CVEs total
| CVE-2016-9480 | libdwarf 基于堆的缓冲区溢出漏洞 | |
| CVE-2016-1251 | DBD::mysql 释放后重用漏洞 | |
| CVE-2016-1247 | F5 Nginx 本地提权漏洞 | |
| CVE-2016-5765 | 多款Micro Focus产品信息泄露漏洞 | |
| CVE-2016-5393 | Apache Hadoop 安全漏洞 |
IV. Related Vulnerabilities
V. Comments for CVE-2016-9481
No comments yet