Is CVE-2016-2242 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2016-2242 being exploited in the wild.

How severe is CVE-2016-2242?

Critical severity, with a CVSS score of 9.8, published 23 January 2017.

Which products and versions are affected?

Exponent CMS Exponent CMS 2.x before 2.3.7 Patch 3.

Is there a fix for CVE-2016-2242?

A patch was published on 2016-01-23: Patch 3 for version 2.3.7 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2016-2242 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2016-2242?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2016-2242: Exponent CMS code injection in install/index.php

CVE-2016-2242 · Severity: critical · CVSS 9.8 · Published 2017-01-23

Exponent CMS, a platform used for building and managing websites, contains a critical security flaw in its installation component. An attacker can exploit this to remotely execute malicious code on the server, potentially leading to a full takeover of the website and its underlying data. This could result in the theft of sensitive information, website defacement, or the use of the server for further attacks.

Quick answers

Is CVE-2016-2242 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2016-2242 being exploited in the wild.
How severe is CVE-2016-2242?: Critical severity, with a CVSS score of 9.8, published 23 January 2017.
Which products and versions are affected?: Exponent CMS Exponent CMS 2.x before 2.3.7 Patch 3.
Is there a fix for CVE-2016-2242?: A patch was published on 2016-01-23: Patch 3 for version 2.3.7 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2016-2242 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2016-2242?: Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A code injection vulnerability exists in Exponent CMS versions 2.x prior to 2.3.7 Patch 3. The flaw is located in the 'install/index.php' script, where the 'sc' parameter is improperly handled, allowing for the injection of malicious PHP code. This is reportedly due to an anomaly in how PHP processes malformed associative arrays, which can be used to mask a payload that modifies the application's configuration file (config.php). A remote, unauthenticated attacker can exploit this over the network to achieve full remote code execution (RCE). Users are advised to upgrade to 2.3.7 Patch 3 or delete the '/install' directory as a temporary mitigation.

Affected products

Exponent CMS Exponent CMS 2.x before 2.3.7 Patch 3

Timeline

2016-01-14: advisory: Initial security notice published by vendor
2016-01-23: patched: Patch 3 for version 2.3.7 released
2017-01-23: disclosed: NVD publication date

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.