EUVD-2026-56038
GHSA-85cw-qx9x-rj5j
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Unauthenticated network-reachable SQLi (AV:N/AC:L/PR:N/UI:N) giving full database read/modify/delete, so C:H/I:H/A:H; scope unchanged as impact stays within the DB.
Primary rating from Vendor (TuranSec).
CVSS VectorVendor: TuranSec
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
2DescriptionCVE.org
An SQL injection vulnerability in e107 2.4.0 allows unauthenticated remote attackers to execute arbitrary SQL via the news item page ID parameter. The parameter is concatenated without escaping into a SQL WHERE clause. An unauthenticated attacker can read, modify, or delete all database contents including administrator credentials.
AnalysisAI
SQL injection in e107 CMS version 2.4.0 (and earlier) lets unauthenticated remote attackers inject arbitrary SQL through the news item page ID parameter, which is concatenated unescaped into a WHERE clause. Because no authentication is required and the flaw yields full read/write/delete access to the backend database - including administrator credential hashes - it enables complete site compromise. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that the target e107 installation (version ≤ 2.4.0) expose its news item page, and that the attacker supply a malicious value in the news item/page ID parameter that reaches the vulnerable WHERE clause; the description states the parameter is concatenated without escaping, so no special server configuration or feature toggle beyond a reachable news page is needed. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The signals are largely aligned toward high priority: the CVSS 3.1 vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (base 9.8) indicates network-reachable, low-complexity, unauthenticated exploitation with total impact to confidentiality, integrity, and availability, which is consistent with the description of an unauthenticated news-parameter SQLi granting full database control. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker discovers an internet-facing e107 site and submits a crafted request to the news item page, injecting SQL through the numeric page/item ID parameter (for example a UNION-based or boolean/time-based payload). With no authentication required, they extract the admin credential table, crack or reuse the hashes to log into the admin panel, and then modify or delete site content - or pivot to the underlying server. … |
| Remediation | No vendor-released patch version is identified at time of analysis - the only reference is the upstream repository (https://github.com/e107inc/e107), not a tagged fixed release, so administrators should monitor that repository and e107 release announcements for a patched version above 2.4.0 and upgrade as soon as one is published. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all e107 CMS installations running version 2.4.0 or earlier and assess internet accessibility; implement temporary network controls to restrict CMS access where feasible and deploy Web Application Firewall rules to block SQL injection patterns in the page ID parameter. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
e107 CMS 3.2.1 has multiple XSS vulnerabilities in news comments that allow executing arbitrary JavaScript. Rated CVSS 9
usersettings.php in e107 through 2.3.0 lacks a certain e_TOKEN protection mechanism. Rated high severity (CVSS 8.8), thi
e107 2.1.8 has CSRF in 'usersettings.php' with an impact of changing details such as passwords of users including admini
e107 CMS version 3.2.1 contains a critical file upload vulnerability that allows authenticated administrators to overrid
e107 2.1.1 allows SQL injection by remote authenticated administrators via the pagelist parameter to e107_admin/menus.ph
e107 CMS version 3.2.1 contains a file upload vulnerability that allows authenticated administrative users to bypass upl
e107 CMS version 3.2.1 contains a file upload vulnerability that allows authenticated administrators to override server
e107_web/js/plupload/upload.php in e107 2.1.8 allows remote attackers to execute arbitrary PHP code by uploading a .php
Cross-site request forgery (CSRF) vulnerability in e107_admin/newspost.php in e107 1.0.1 allows remote attackers to hija
Multiple cross-site request forgery (CSRF) vulnerabilities in e107_admin/download.php in e107 1.0.2 allow remote attacke
e107 2.1.8 has XSS via the e107_admin/users.php?mode=main&action=list user_loginname parameter. Rated medium severity (C
Cross Site Scripting vulnerability in e107 v.2.3.2 allows a remote attacker to execute arbitrary code via the descriptio
Same weakness CWE-89 – SQL Injection
View allShare
External POC / Exploit Code
Leaving vuln.today