Exponent CMS v0.97 Multiple Vulnerabilities
Exponent CMS suffers from multiple vulnerabilities: Local File Inclusion / File Disclosure Vulnerability occurs when input passed thru the params: 'action', 'expid', 'ajax_action', 'printerfriendly', 'section', 'module', 'controller', 'int', 'src', 'template', 'page', '_common' to the scripts: 'index.php', 'login_redirect.php', 'mod_preview.php', 'podcast.php', 'popup.php', 'rss.php' is not properly verified before being used to include files. This can be exploited to include files from local resources with directory traversal attacks and URL encoded NULL bytes. Arbitrary File Upload / File Modify Vulnerability occurs due to an error in 'upload_fileuploadcontrol.php', 'upload_standalone.php', 'manifest.php', 'delete.php', 'edit.php', 'manage.php', 'rank_switch.php', 'save.php', 'view.php', 'class.php', 'deps.php', 'delete_form.php', 'delete_process.php', 'search.php', 'send_feedback.php', 'viewday.php', 'viewmonth.php', 'viewweek.php', 'testbot.php', 'activate_bot.php', 'deactivate_bot.php', 'manage_bots.php', 'run_bot.php', 'class.php', 'delete_board.php', 'delete_post.php', 'edit_board.php', 'edit_post.php', 'edit_rank.php', 'monitor_all_boards.php', 'monitor_board.php', 'monitor_thread.php', 'preview_post.php', 'save_board.php', 'save_post.php', 'save_rank.php', 'view_admin.php', 'view_board.php', 'view_rank.php', 'view_thread.php', 'banner_click.php', 'ad_delete.php', 'ad_edit.php', 'ad_save.php', 'af_delete.php', 'af_edit.php', 'af_save.php', 'delete_article.php', 'edit_article.php', 'save_article.php', 'save_submission.php', 'submit_article.php', 'view_article.php', 'view_submissions.php', 'coretasks.php', 'delete_task.php', 'edit_task.php', 'save_task.php', 'view_task.php', 'delete_form.php', 'delete_process.php', 'edit_form.php', 'edit_process.php', 'save_form.php', 'save_process.php', 'view_form.php', 'view_process.php' which can be exploited to upload arbitrary files with malicious code in them. Reflected Cross-Site Scripting Vulnerability occurs due to an error in 'index.php', 'login_redirect.php', 'mod_preview.php', 'podcast.php', 'popup.php', 'rss.php' which can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site.
