CVE-2026-55572
CriticalCVSS 10.0Summary
In e107 CMS prior to 2.3.7, the bundled alt_auth plugin's otherdb and e107db authentication backends interpolate the submitted login username directly into SQL in e107_plugins/alt_auth/otherdb_auth.php and e107_plugins/alt_auth/e107db_auth.php. The login() methods execute those strings with PDO::query() before effective sanitization, so an unauthenticated user can inject SQL when alt_auth is installed and either backend is configured with a live external database connection. The injection can expose or modify data available to the configured database account, and query failures can additionally disclose the generated query through the debug-message path.
Risk Assessment
The vulnerability allows an unauthenticated attacker to inject SQL and access database data, including modification or disclosure. This poses a high risk to data confidentiality and integrity.
Recommendation
Immediately update e107 to version 2.3.7 or later. Until patched, disable the alt_auth plugin or restrict its configuration.
Other vulnerabilities in e107
See all- CVE-2026-57859High
e107 prior to version 2.3.8 contains a code execution vulnerability in the e_array deserialization handler. An attacker with database write access can store a crafted payload in the user_prefs column, which upon materialization of user preferences is passed to eval(), leading to automatic execution of arbitrary PHP code.
- CVE-2016-10378High
e107 version 2.1.1 allows SQL injection by remote authenticated administrators via the pagelist parameter to e107_admin/menus.php, related to the menuSaveVisibility function.
- CVE-2026-55573Critical
In e107 CMS prior to 2.3.7, install.php decodes the attacker-controlled previous_steps POST parameter and passes it to unserialize() at file scope and again in the e_install constructor without restricting allowed classes. The installer remains accessible after a normal installation, and a crafted object graph using the bundled GuzzleHttp\Psr7\PumpStream class can flow through paths.hash into site_path, where string coercion invokes an attacker-controlled callable. An unauthenticated attacker who can reach install.php can therefore execute arbitrary PHP functions with the web server process's privileges, leading to full server compromise.
- CVE-2026-72599Critical
An SQL injection vulnerability in e107 2.4.0 allows unauthenticated remote attackers to execute arbitrary SQL via the news item page ID parameter. The parameter is concatenated without escaping into a SQL WHERE clause.
- CVE-2026-43936Medium
e107 CMS prior to version 2.3.4 allows access to the local environment by specifying a local URL in the "Image/File URL:" field of the "From a remote location" option in the Media Manager on the admin screen. This vulnerability is fixed in version 2.3.4.
- CVE-2026-43935High
In e107 before 2.3.4, a Host Header Injection vulnerability in the password reset page allows attackers to generate password reset links pointing to attacker-controlled domains.
- CVE-2026-43934Medium
e107 is a content management system (CMS). Prior to 2.3.4, a Broken Access Control vulnerability exists in the application, allowing an unauthorized authenticated user to edit comments posted by others. This stems from inadequate server-side access control validation, where the application depends only on a predictable identifier in the request to determine which comment to edit, without confirming the requesting user’s ownership of the comment.
Original NVD description (English source)
e107 is a content management system (CMS). Prior to 2.3.7, the bundled alt_auth plugin's otherdb and e107db authentication backends interpolate the submitted login username directly into SQL in e107_plugins/alt_auth/otherdb_auth.php and e107_plugins/alt_auth/e107db_auth.php. The login() methods execute those strings with PDO::query() before effective sanitization, so an unauthenticated user can inject SQL when alt_auth is installed and either backend is configured with a live external database connection. The injection can expose or modify data available to the configured database account, and query failures can additionally disclose the generated query through the debug-message path. This issue is fixed in version 2.3.7.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS