Vulnerability: In /framework/modules/notfound/controllers/notfoundController.php of Exponent CMS 2.4.0 patch1, untrusted input is passed into getSearchResults. The method getSearchResults is defined in the search model with the parameter '$term' used directly in SQL. Impact is a SQL injection.
Vulnerability ID: CVE-2016-9287
CWE: CWE-89
Severity score: 6.4
Project: https://github.com/exponentcms/exponent-cms
Published: 2016-11-15
File: framework/modules/notfound/controllers/notfoundController.php
Commit message: fix sql injection issue in notfound controller; reported by pang0lin
Commit author: dleffler

Vulnerable version (before fix):
 static function description() { return gt("This controller handles routing to th     static function hasSources() { return false; }     static function hasViews() { return false; }     static function hasContent() { return false; }          public function handle() {         global $router;          $args = array_merge(array('controller'=>'notfound', 'action'=>'page_not_found'), $router->url_parts);            header("Refresh: 0; url=".$router->makeLink($args), false, 404);     }          public function page_not_found() {         global $router;  public function page_not_found() {         if (get_magic_quotes_gpc()) {             $terms = stripslashes($terms);         }         $terms = htmlspecialchars($terms);          // check for server requested error documents here instead of treating them as a search request         if ($terms == SITE_404_FILE) {

Fixed version (after fix):
 static function description() { return gt("This controller handles routing to th     static function hasSources() { return false; }     static function hasViews() { return false; }     static function hasContent() { return false; }      public function handle() {         global $router;          $args = array_merge(array('controller'=>'notfound', 'action'=>'page_not_found'), $router->url_parts);         header("Refresh: 0; url=".$router->makeLink($args), false, 404);     }      public function page_not_found() {         global $router;  public function page_not_found() {         if (get_magic_quotes_gpc()) {             $terms = stripslashes($terms);         }         $terms = expString::escape(htmlspecialchars($terms));          // check for server requested error documents here instead of treating them as a search request         if ($terms == SITE_404_FILE) {

Patch:
patch: @@ -32,14 +32,14 @@ static function description() { return gt("This controller handles routing to th
     static function hasSources() { return false; }
     static function hasViews() { return false; }
     static function hasContent() { return false; }
-    
+
     public function handle() {
         global $router;
 
-        $args = array_merge(array('controller'=>'notfound', 'action'=>'page_not_found'), $router->url_parts);   
+        $args = array_merge(array('controller'=>'notfound', 'action'=>'page_not_found'), $router->url_parts);
         header("Refresh: 0; url=".$router->makeLink($args), false, 404);
     }
-    
+
     public function page_not_found() {
         global $router;
 
@@ -60,7 +60,7 @@ public function page_not_found() {
         if (get_magic_quotes_gpc()) {
             $terms = stripslashes($terms);
         }
-        $terms = htmlspecialchars($terms);
+        $terms = expString::escape(htmlspecialchars($terms));
 
         // check for server requested error documents here instead of treating them as a search request
         if ($terms == SITE_404_FILE) {
path: framework/modules/notfound/controllers/notfoundController.php