Executive brief
Exponent CMS, a platform used for building and managing websites, contains a critical security flaw in its installation component. An attacker can exploit this to remotely execute malicious code on the server, potentially leading to a full takeover of the website and its underlying data. This could result in the theft of sensitive information, website defacement, or the use of the server for further attacks.
Technical details
A code injection vulnerability exists in Exponent CMS versions 2.x prior to 2.3.7 Patch 3. The flaw is located in the 'install/index.php' script, where the 'sc' parameter is improperly handled, allowing for the injection of malicious PHP code. This is reportedly due to an anomaly in how PHP processes malformed associative arrays, which can be used to mask a payload that modifies the application's configuration file (config.php). A remote, unauthenticated attacker can exploit this over the network to achieve full remote code execution (RCE). Users are advised to upgrade to 2.3.7 Patch 3 or delete the '/install' directory as a temporary mitigation.
Affected products
- Exponent CMS Exponent CMS 2.x before 2.3.7 Patch 3
Timeline
- 2016-01-14: advisory: Initial security notice published by vendor
- 2016-01-23: patched: Patch 3 for version 2.3.7 released
- 2017-01-23: disclosed: NVD publication date
References
- http://packetstormsecurity.com/files/135721/Exponent-2.3.7-PHP-Code-Execution.html
- http://www.exponentcms.org/news/patch-3-released-for-v2-3-7
- http://www.exponentcms.org/news/show/title/security-notice-closing-an-exponent-security-vulnerability
- http://www.securityfocus.com/archive/1/537499/100/0/threaded
- https://www.htbridge.com/advisory/HTB23290