e107 vulnerabilities

e107 prior to version 2.3.8 contains a code execution vulnerability in the e_array deserialization handler. An attacker with database write access can store a crafted payload in the user_prefs column, which upon materialization of user preferences is passed to eval(), leading to automatic execution of arbitrary PHP code.

e107 version 2.1.1 allows SQL injection by remote authenticated administrators via the pagelist parameter to e107_admin/menus.php, related to the menuSaveVisibility function.

An SQL injection vulnerability in e107 2.4.0 allows unauthenticated remote attackers to execute arbitrary SQL via the news item page ID parameter. The parameter is concatenated without escaping into a SQL WHERE clause.

e107 CMS prior to version 2.3.4 allows access to the local environment by specifying a local URL in the "Image/File URL:" field of the "From a remote location" option in the Media Manager on the admin screen. This vulnerability is fixed in version 2.3.4.

In e107 before 2.3.4, a Host Header Injection vulnerability in the password reset page allows attackers to generate password reset links pointing to attacker-controlled domains.

e107 is a content management system (CMS). Prior to 2.3.4, a Broken Access Control vulnerability exists in the application, allowing an unauthorized authenticated user to edit comments posted by others. This stems from inadequate server-side access control validation, where the application depends only on a predictable identifier in the request to determine which comment to edit, without confirming the requesting user’s ownership of the comment.