CVE-2021-32441

Summary

SQL Injection vulnerability in Exponent-CMS v.2.6.0 fixed in 2.7.0 allows attackers to gain access to sensitive information via the selectValue function in the expConfig class.

Affected Software

Weaknesses

• n/a

ADP Enrichment

CVE Program Container

Additional References

• https://github.com/exponentcms/exponent-cms/issues/1542
• https://github.com/pang0lin/CVEproject/blob/main/ExponentCMS_v2.6.0_sqli.md

CISA ADP Vulnrichment

• SSVC:
• Exploitation: none
  • Automatable: yes
  • Technical Impact: partial

References

• https://github.com/exponentcms/exponent-cms/issues/1542
• https://github.com/pang0lin/CVEproject/blob/main/ExponentCMS_v2.6.0_sqli.md

• ←Previous
• Next→