PatchSiren

PatchSiren cyber security CVE debrief

CVE-2016-5742 Sixapart CVE debrief

CVE-2016-5742 is a critical SQL injection vulnerability in Movable Type’s XML-RPC interface. According to the NVD record, a remote attacker can execute arbitrary SQL commands, which can expose, alter, or destroy data in affected installations. The issue affects Movable Type Pro and Advanced 6.x before 6.1.3 and 6.2.x before 6.2.6, as well as Movable Type Open Source 5.2.13 and earlier. The CVE record was published on 2017-01-23, while the linked vendor release notes and security references date to 2016-06-22, indicating that fixed releases were available by that time.

Vendor
Sixapart
Product
Movable Type
CVSS
CRITICAL 9.8
CISA KEV
Not listed in stored evidence
Original CVE published
2017-01-23
Original CVE updated
2026-05-13
Advisory published
2017-01-23
Advisory updated
2026-05-13

Who should care

Administrators and security teams responsible for Movable Type Pro/Advanced 6.x or Movable Type Open Source 5.2.13 and earlier, especially if XML-RPC is exposed to untrusted networks. Database administrators should also care because successful exploitation can directly affect the backend database.

Technical summary

NVD classifies the flaw as CWE-89 (SQL Injection) with CVSS 3.0 vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. The vulnerability is in the XML-RPC interface and is reachable remotely without privileges or user interaction. The reported impact is arbitrary SQL command execution, which implies potential full compromise of application data confidentiality, integrity, and availability.

Defensive priority

Critical. Treat as an urgent patching issue for any exposed or production Movable Type deployment in the affected version ranges.

Recommended defensive actions

  • Upgrade Movable Type Pro/Advanced to 6.1.3 or 6.2.6, or later.
  • Upgrade Movable Type Open Source to a version later than 5.2.13.
  • If immediate upgrading is not possible, restrict access to the XML-RPC interface to trusted hosts only until remediation is complete.
  • Review application and database logs for suspicious XML-RPC requests or unexpected SQL-related errors.
  • Validate that no legacy deployments remain on affected versions across all environments, including staging and archived instances.

Evidence notes

Source corpus supports the affected versions, attack surface, and impact: the NVD record lists SQL injection in the XML-RPC interface, remote arbitrary SQL execution, CWE-89, and the affected version ranges. The referenced Movable Type release notes on 2016-06-22 indicate the fixed 6.1.3 and 6.2.6 releases. CVE publication date used here is 2017-01-23 from the supplied record; that is distinct from the earlier vendor reference dates.

Sources and references

Verified primary and authoritative sources

  • CVE-2016-5742 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2016-5742

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2016-5742 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2016-5742

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.