Exponent CMS - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/vendors/exponent-cms/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioMon, 12 Oct 2026 18:32:13 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgSQL Injection in Exponent CMS XML-RPC Componenthttps://feed.craftedsignal.io/briefs/2026-10-exponent-cms-sqli/Mon, 12 Oct 2026 18:32:13 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-10-exponent-cms-sqli/Exponent CMS versions up to 3.0.2patch2 contain a SQL injection vulnerability in the userLogin function within xmlrpc.php that allows unauthenticated remote attackers to execute arbitrary SQL commands.A critical security vulnerability has been identified in Exponent CMS versions up to 3.0.2patch2. The flaw exists within the userLogin function located in the xmlrpc.php file, which is part of the system's XML-RPC component. This vulnerability is classified as a SQL injection (SQLi) issue that can be triggered remotely by an unauthenticated attacker. The vulnerability stems from improper sanitization of input provided to the XML-RPC interface. Since a public exploit for this vulnerability exists and the vendor has not provided a patch, installations running affected versions are at high risk of database compromise, including unauthorized data exfiltration or potential administrative account takeover. Defenders should prioritize auditing web server access logs for anomalous traffic targeting xmlrpc.php and evaluate migrating or isolating instances of Exponent CMS.

Impact

Successful exploitation of CVE-2026-108900 allows an unauthenticated remote attacker to execute arbitrary SQL commands against the underlying database. This could lead to full unauthorized access to sensitive application data, modification of user credentials, or database manipulation. The impact is severe, particularly as the vulnerability is publicly disclosed and likely being targeted by automated scanners or opportunistic threat actors.

Recommendation

  • Monitor web server logs for HTTP requests targeting the /xmlrpc.php endpoint, specifically looking for abnormal strings associated with SQL injection payloads (e.g., SELECT, UNION, WAITFOR, or sleep commands).
  • If possible, restrict access to the xmlrpc.php file at the web server (Nginx/Apache) level or block the file entirely if XML-RPC functionality is not required for site operations.
  • Audit web application logs to detect unauthorized calls to the userLogin function within the XML-RPC component.
  • Since no vendor patch is currently available, evaluate if the CMS instance can be migrated to a secure platform or placed behind a Web Application Firewall (WAF) with specific rulesets designed to block SQL injection attempts.
]]>highadvisorysqliweb-applicationcmsvulnerability