PatchSiren

PatchSiren cyber security CVE debrief

CVE-2016-5742 Sixapart CVE debrief

CVE-2016-5742 is a critical SQL injection vulnerability in Movable Type’s XML-RPC interface. According to the NVD record, a remote attacker can execute arbitrary SQL commands, which can expose, alter, or destroy data in affected installations. The issue affects Movable Type Pro and Advanced 6.x before 6.1.3 and 6.2.x before 6.2.6, as well as Movable Type Open Source 5.2.13 and earlier. The CVE record was published on 2017-01-23, while the linked vendor release notes and security references date to 2016-06-22, indicating that fixed releases were available by that time.

Vendor
Sixapart
Product
CVE-2016-5742
CVSS
CRITICAL 9.8
CISA KEV
Not listed in stored evidence
Original CVE published
2017-01-23
Original CVE updated
2026-05-13
Advisory published
2017-01-23
Advisory updated
2026-05-13

Who should care

Administrators and security teams responsible for Movable Type Pro/Advanced 6.x or Movable Type Open Source 5.2.13 and earlier, especially if XML-RPC is exposed to untrusted networks. Database administrators should also care because successful exploitation can directly affect the backend database.

Technical summary

NVD classifies the flaw as CWE-89 (SQL Injection) with CVSS 3.0 vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. The vulnerability is in the XML-RPC interface and is reachable remotely without privileges or user interaction. The reported impact is arbitrary SQL command execution, which implies potential full compromise of application data confidentiality, integrity, and availability.

Defensive priority

Critical. Treat as an urgent patching issue for any exposed or production Movable Type deployment in the affected version ranges.

Recommended defensive actions

  • Upgrade Movable Type Pro/Advanced to 6.1.3 or 6.2.6, or later.
  • Upgrade Movable Type Open Source to a version later than 5.2.13.
  • If immediate upgrading is not possible, restrict access to the XML-RPC interface to trusted hosts only until remediation is complete.
  • Review application and database logs for suspicious XML-RPC requests or unexpected SQL-related errors.
  • Validate that no legacy deployments remain on affected versions across all environments, including staging and archived instances.

Evidence notes

Source corpus supports the affected versions, attack surface, and impact: the NVD record lists SQL injection in the XML-RPC interface, remote arbitrary SQL execution, CWE-89, and the affected version ranges. The referenced Movable Type release notes on 2016-06-22 indicate the fixed 6.1.3 and 6.2.6 releases. CVE publication date used here is 2017-01-23 from the supplied record; that is distinct from the earlier vendor reference dates.

Official resources

Publicly disclosed through official and third-party references tied to the CVE record. The supplied record shows the CVE published on 2017-01-23, with linked vendor release notes and advisories dated 2016-06-22.