| Title | Exponentcms Exponent CMS ≤3.0.2 SQL Injection |
|---|
| Description | When Exponent CMS has USE_XMLRPC enabled, the public xmlrpc.php endpoint exposes MetaWeblog/Blogger XML-RPC methods. The shared helper userLogin() concatenates the attacker-controlled username directly into a SQL WHERE clause without expString::escape() or parameterized queries.
This is an unauthenticated SQL injection on an authentication path. The normal web login flow in loginController escapes credentials before calling user::login(), but the XML-RPC path does not reuse that protection. |
|---|
| Source | ⚠️ https://github.com/dddwmr/CVE/blob/main/SQL%20Injection%20in%20xmlrpc.php%20userLogin%20username%20handling%20when%20USE_XMLRPC%20is%20enabled.md |
|---|
| User | dwmm (UID 29483) |
|---|
| Submission | 09/14/2026 07:56 (1 month ago) |
|---|
| Moderation | 10/11/2026 16:43 (27 days later) |
|---|
| Status | Accepted |
|---|
| VulDB entry | 416691 [Exponent CMS up to 3.0.2patch2 XML-RPC xmlrpc.php userLogin sql injection] |
|---|
| Points | 20 |
|---|