SQL Injection in Exponent CMS XML-RPC Component

A critical security vulnerability has been identified in Exponent CMS versions up to 3.0.2patch2. The flaw exists within the userLogin function located in the xmlrpc.php file, which is part of the system's XML-RPC component. This vulnerability is classified as a SQL injection (SQLi) issue that can be triggered remotely by an unauthenticated attacker. The vulnerability stems from improper sanitization of input provided to the XML-RPC interface. Since a public exploit for this vulnerability exists and the vendor has not provided a patch, installations running affected versions are at high risk of database compromise, including unauthorized data exfiltration or potential administrative account takeover. Defenders should prioritize auditing web server access logs for anomalous traffic targeting xmlrpc.php and evaluate migrating or isolating instances of Exponent CMS.

Impact

Successful exploitation of CVE-2026-108900 allows an unauthenticated remote attacker to execute arbitrary SQL commands against the underlying database. This could lead to full unauthorized access to sensitive application data, modification of user credentials, or database manipulation. The impact is severe, particularly as the vulnerability is publicly disclosed and likely being targeted by automated scanners or opportunistic threat actors.

Recommendation

• Monitor web server logs for HTTP requests targeting the /xmlrpc.php endpoint, specifically looking for abnormal strings associated with SQL injection payloads (e.g., SELECT, UNION, WAITFOR, or sleep commands).
• If possible, restrict access to the xmlrpc.php file at the web server (Nginx/Apache) level or block the file entirely if XML-RPC functionality is not required for site operations.
• Audit web application logs to detect unauthorized calls to the userLogin function within the XML-RPC component.
• Since no vendor patch is currently available, evaluate if the CMS instance can be migrated to a secure platform or placed behind a Web Application Firewall (WAF) with specific rulesets designed to block SQL injection attempts.