CVE-2017-5879 Exponentcms CVE debrief

Who should care

Administrators and operators of Exponent CMS 2.4.1, especially if the instance is internet-facing. Security teams, application owners, and database administrators should also review exposure because the issue is unauthenticated and can lead to database disclosure.

Technical summary

NVD classifies the weakness as CWE-89 with CVSS 3.0 vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. The affected component is source_selector.php, and the vulnerable input is the src parameter. Because the issue is reachable over HTTP GET without authentication, it presents a high-risk remote attack surface and may allow blind SQL injection with out-of-band data leakage.

Defensive priority

Urgent

Recommended defensive actions

• Confirm whether Exponent CMS 2.4.1 is deployed anywhere in your environment, including legacy or externally hosted instances.
• Use the vendor issue tracker reference associated with issue 73 to verify the patch or remediation status before re-exposing the application.
• Upgrade or replace any affected Exponent CMS 2.4.1 deployment with a fixed version or a supported alternative as soon as possible.
• Restrict or remove public access to the affected application until remediation is complete.
• Review web logs for requests to source_selector.php and unusual patterns involving the src parameter.
• Audit database credentials and privileges used by the application, and rotate secrets if exposure is suspected.
• If database or application access is compromised, validate integrity of affected data and review for unauthorized exports or other signs of SQL injection abuse.

Evidence notes

The debrief is based on the official NVD record and the linked vendor/third-party references supplied in the source corpus. The CVE was published on 2017-02-06 and later modified on 2026-05-13; that later date reflects record maintenance, not the original vulnerability date. The supplied corpus does not include a fixed version number, so remediation guidance is limited to confirming the referenced patch and eliminating exposure to the affected version.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.