e107 CMS vulnerabilities

Critical vulnerability in e107 CMS version 3.2.1 allows authenticated administrators to overwrite arbitrary server files via path traversal in the Media Manager's remote URL upload functionality (image.php). The upload_caption parameter is not properly sanitized, enabling directory traversal sequences like ../../../ to overwrite files outside the intended directory. This can lead to complete compromise of the web application.

CVE-2022-50916 affects e107 CMS version 3.2.1. The vulnerability is a file upload flaw in the Media Manager import functionality that allows authenticated administrators to overwrite server files, such as top.php in the web application directory.

CVE-2022-50907 affects e107 CMS version 3.2.1. The vulnerability allows authenticated administrative users to bypass upload restrictions and execute PHP files by manipulating the upload URL parameter in the Media Manager import feature. This enables remote code execution on the server.

e107 CMS version 3.2.1 contains multiple vulnerabilities allowing XSS attacks. The first is a reflected XSS in the news comment functionality, where an authenticated user can inject malicious JavaScript via a URL parameter. The second is an upload restriction bypass for admins, allowing SVG files with malicious code to be uploaded via the media manager's remote URL feature, leading to stored XSS.

e107 is a content management system (CMS), versions 2.3.5 and earlier contain a command injection vulnerability in the ImageMagick resize destination path. In the resize_image() function, the source path is properly escaped, but the destination path is inserted inside raw double quotes, allowing an attacker to inject malicious code.

CSRF vulnerability in e107 CMS before version 2.3.5. The CSRF token validation is skipped if no token is present in the request.

e107 CMS 2.3.0 allows authenticated users with theme installation permissions to execute arbitrary code by uploading a malicious theme file. Attackers can upload a crafted theme package via the theme.php endpoint that deploys a web shell to the e107_themes directory, then execute system commands via the payload.php script.

A vulnerability was detected in e107 CMS up to 2.3.3. It impacts an unknown function of the file /e107_admin/image.php?mode=main&action=avatar of the Avatar Handler component. Manipulation of the multiaction[] argument results in path traversal. The attack can be initiated remotely and the exploit is now public.