Executive brief
Exponent CMS, an open-source content management system used for building and managing websites, contains a security flaw that allows logged-in users to inject malicious scripts into the site's content. If an attacker successfully exploits this, they can execute unauthorized code in the browsers of other users, potentially leading to account takeover or data theft. Additionally, the system inadvertently reveals database login credentials and lacks protection against automated password-guessing attacks, further increasing the risk of a full site compromise.
Technical details
Exponent CMS 2.6 and earlier versions contain a stored cross-site scripting (XSS) vulnerability within the 'Title' and 'Text Block' parameters of the text editing endpoint. Authenticated attackers can inject malicious iframe payloads containing SVG onload events to execute arbitrary JavaScript in the context of other users' sessions. Furthermore, the application suffers from information disclosure by exposing database credentials (server, username, and database name) in certain responses. The authentication mechanism also lacks brute-force protection, such as rate limiting or account lockout, allowing for automated credential stuffing or password guessing. While version 2.7.2 and 3.0.2 have been released, users are encouraged to upgrade to the latest versions to mitigate these risks.
Affected products
- Exponent CMS Exponent CMS <= 2.6
Timeline
- 2021-10-22: other: Vulnerability discovered by researchers
- 2021-12-20: disclosed: Exploit published on Exploit-DB
- 2024-12-26: patched: Version 2.7.2 and 3.0.2 released
- 2026-05-10: advisory: CVE published/updated in NVD