Description

A vulnerability has been found in Exponent CMS up to 3.0.2patch2. Affected is the function userLogin of the file xmlrpc.php of the component XML-RPC. Such manipulation leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.3",
  "pubDate": "2026-10-12T16:17:03.533Z",
  "pubdate": "2026-10-12T16:17:03.533Z",
  "executiveSummary": "A critical SQL injection vulnerability exists in Exponent CMS up to version 3.0.2patch2. The flaw resides within the userLogin function of the XML-RPC component, allowing remote, unauthenticated attackers to execute arbitrary SQL queries against the underlying database.\nThis vulnerability poses a significant risk to the integrity and confidentiality of the affected system. Successful exploitation enables unauthorized data exfiltration, modification of database contents, and potential escalation of privileges. Because the vulnerability is remotely exploitable and proof-of-concept exploits have been publicly disclosed, the risk of active exploitation is high.\nThe vendor was notified of the issue but has not responded, meaning no official security patches are available for this specific flaw. Organizations running affected versions are strongly advised to restrict access to the XML-RPC interface or migrate to a more secure platform.",
  "technicalDetails": "The vulnerability is located in the xmlrpc.php file, specifically within the userLogin function. The flaw stems from insufficient sanitization of user-supplied input before it is processed by the database query logic.\nThe XML-RPC interface, which typically facilitates remote procedural calls, fails to properly escape or parameterize input parameters passed to the userLogin handler. When a malicious actor submits a crafted XML-RPC request, they can inject SQL meta-characters (such as single quotes or comment sequences) into the SQL query string constructed by the application.\nThe attack flow follows these steps: 1) The attacker constructs a malicious XML-RPC payload targeting the userLogin method. 2) The payload includes SQL injection sequences within the parameters intended for database lookup. 3) The application receives the request and passes these parameters directly into a database query execution function without validation. 4) The database engine executes the injected SQL commands as part of the intended query. 5) The attacker leverages the resulting database response to extract sensitive information, such as user credentials, session tokens, or configuration data.\nBecause this interface is exposed via the network and does not require pre-authentication, the attack surface is wide, and exploitation can be automated. The impact is severe, as the attacker can manipulate the database backend, potentially leading to unauthorized administrative access. Given the lack of input validation, the application is susceptible to techniques such as UNION-based SQL injection, blind SQL injection, or error-based SQL injection, depending on the server configuration and database response patterns."
}