e107 CMS CVE-2026-55572

Requires the alt_auth plugin to be installed and either the otherdb or e107db authentication backend configured with a live, reachable external database connection; under that configuration an unauthenticated attacker triggers the flaw simply by submitting a crafted login username, which is interpolated into SQL and run via PDO::query() before effective sanitization. Limiting factors: alt_auth is not installed by default and the vulnerable backend must be actively pointed at an external DB, so default e107 installs are not exposed; impact is bounded by the privileges of the configured external database account; failed queries can additionally disclose the generated query through the debug-message path, aiding blind injection. No user interaction or authentication is needed once the prerequisite configuration exists.

Signals are mixed. The input CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H = 10.0) frames this as a worst-case, unauthenticated, remote, scope-changing SQL injection (CWE-89), and that is directionally correct - no credentials or user interaction are required to reach the vulnerable login() path. However, the real-world risk is materially gated by a deployment prerequisite the raw score ignores: the alt_auth plugin must be installed AND the otherdb or e107db backend must be configured against a live external database. e107's alt_auth is not a default-enabled component, so the exploitable population is a subset of an already modest e107 install base. No EPSS score, CISA KEV listing, or public POC is present in the provided intelligence, so there is no evidence of active or widespread exploitation - the 10.0 reflects theoretical worst-case impact, not demonstrated attacker activity. I also assess the A:H in the input as not fully supported: the description states data can be exposed or modified for the configured DB account but does not establish an availability/destruction impact, so C:H/I:H are justified while A:H appears inflated - verify with vendor. Net: a genuinely serious flaw worth prompt patching wherever alt_auth+external-DB is configured, but likely low priority for the majority of e107 deployments that do not run that configuration.

An attacker locates an e107 site (< 2.3.7) that has the alt_auth plugin installed with the otherdb or e107db backend wired to an external database. Without any account, the attacker submits a crafted username in the login form; because the value is interpolated into SQL and executed via PDO::query() before sanitization, the injection runs against the external DB, letting the attacker read or alter data in the scope of that DB account (failed queries may also leak the generated SQL via the debug-message path). No public exploit code is identified at time of analysis.