CVE-2016-9022 (PHP, published 2020-12-31T03:15Z)
Description: value: Exponent CMS before 2.6.0 has improper input validation in usersController.php.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-20 \u2014 Improper Input Validation
The product receives input or data, but it does
        not validate or incorrectly validates that the input has the
        properties that are required to process the data safely and
        correctly.
Repository: https://github.com/exponentcms/exponent-cms
Files changed:
cron/find_help.php
framework/modules/ecommerce/controllers/cartController.php
framework/modules/ecommerce/controllers/purchaseOrderController.php
framework/modules/ecommerce/controllers/storeController.php
framework/modules/file/controllers/fileController.php
framework/modules/users/controllers/usersController.php
Commit message: second effort to greatly enhance system security (xss, sql inject, file exploit, rce, etc...), thanks to felixk3y


Vulnerable code:
            $version = $db->selectValue('help_version', 'id', 'version="' . expString::sanitize($_GET['version']) . '"');
                    /*if ($quantity < $child->minimum_order_quantity)                       
                        flash('message', $child->title . " - " . $child->model . " has a minimum order quantity of " . $child->minimum_order_quantity . 
                        
                //$newqty = $item->product->updateQuantity($this->params['value']);                  
                //}                           
                /*eDebug($item->quantity);   
                eDebug($item->product->quantity); 
                eDebug($qCheck);                  
                        /*$updates->message = $item->products_name.' only has '.$item->product->quantity.' on hand. You can not add any more to your cart.';                        
            //to something other than 0, then we have, but we'll set the estimtae to shipping_total to 
            //{    
                // get all current discount codes that are valid and applied                
            // save out the cart total to the database		
        $discount = $discount->getCouponByName($this->params['coupon_code']);
            //redirect_to(array('controller'=>'cart', 'action'=>'checkout'));       
        //redirect_to(array('controller'=>'cart', 'action'=>'checkout'));                           
        //group items by type and id               
        //eDebug($order,true); 
        
        
        $options = array();  
                
                    $cost = $selected_option->updown == '+' ? $cost : $cost * -1;                      
        
			$purchase_orders = $this->purchase_order->find('all', 'vendor_id=' . $this->params['vendor']);
        $id = isset($this->params['title']) ? $this->params['title'] : $this->params['id'];
        $product = new product(addslashes($this->params['title']));
        $model = $product->find("first", 'model="' . $this->params['model'] . '"');
        $parent = !empty($catid) ? $catid : (!empty($this->params['cat']) ? $this->params['cat'] : 0);
        $terms = $this->params['search_string'];
            $results = $this->params['results'];
            $startIndex = $this->params['startIndex'];
                $sort = $this->params['sort'];
            $results = $this->params['results'];
            $startIndex = $this->params['startIndex'];
            $sort = $this->params['sort'];
//            $this->params['query'] = $this->params['query'];


Fixed code:
            $version = $db->selectValue('help_version', 'id', 'version="' . expString::escape($_GET['version']) . '"');
                    /*if ($quantity < $child->minimum_order_quantity)
                        flash('message', $child->title . " - " . $child->model . " has a minimum order quantity of " . $child->minimum_order_quantity .

                //$newqty = $item->product->updateQuantity($this->params['value']);
                //}
                /*eDebug($item->quantity);
                eDebug($item->product->quantity);
                eDebug($qCheck);
                        /*$updates->message = $item->products_name.' only has '.$item->product->quantity.' on hand. You can not add any more to your cart.';
            //to something other than 0, then we have, but we'll set the estimtae to shipping_total to
            //{
                // get all current discount codes that are valid and applied
            // save out the cart total to the database
        $discount = $discount->getCouponByName(expString::escape($this->params['coupon_code']));
            //redirect_to(array('controller'=>'cart', 'action'=>'checkout'));
        //redirect_to(array('controller'=>'cart', 'action'=>'checkout'));
        //group items by type and id
        //eDebug($order,true);


        $options = array();

                    $cost = $selected_option->updown == '+' ? $cost : $cost * -1;

			$purchase_orders = $this->purchase_order->find('all', 'vendor_id=' . expString::escape($this->params['vendor']));
        $id = isset($this->params['title']) ? expString::escape($this->params['title']) : $this->params['id'];
        $product = new product(expString::escape($this->params['title']));
        $model = $product->find("first", 'model="' . expString::escape($this->params['model']) . '"');
        $parent = !empty($catid) ? $catid : (!empty($this->params['cat']) ? intval($this->params['cat']) : 0);
        $terms = expString::escape($this->params['search_string']);
        $this->params['query'] = expString::escape($this->params['query']);
        $this->params['query'] = expString::escape($this->params['query']);

        $this->params['query'] = expString::escape($this->params['query']);
            $results = intval($this->params['results']);
            $startIndex = intval($this->params['startIndex']);
                $sort = expString::escape($this->params['sort']);
            $this->params['query'] = expString::escape($this->params['query']);
            $results = intval($this->params['results']);
            $startIndex = intval($this->params['startIndex']);
            $sort = expString::escape($this->params['sort']);
            $this->params['query'] = expString::escape($this->params['query']);