CVE-2026-55572 Details
Description
e107 is a content management system (CMS). Prior to 2.3.7, the bundled alt_auth plugin's otherdb and e107db authentication backends interpolate the submitted login username directly into SQL in e107_plugins/alt_auth/otherdb_auth.php and e107_plugins/alt_auth/e107db_auth.php. The login() methods execute those strings with PDO::query() before effective sanitization, so an unauthenticated user can inject SQL when alt_auth is installed and either backend is configured with a live external database connection. The injection can expose or modify data available to the configured database account, and query failures can additionally disclose the generated query through the debug-message path. This issue is fixed in version 2.3.7.
A SQL injection vulnerability has been identified in the e107 content management system, specifically in versions prior to 2.3.7. The issue resides within the alt_auth plugin's otherdb and e107db authentication backends, which directly interpolate the submitted login username into SQL queries without proper sanitization. This vulnerability allows an unauthenticated user to inject SQL commands that could be executed against a configured external database, potentially exposing or modifying data based on the database account's privileges. The vulnerability is present in all 2.x releases up to and including the current master (2.4 dev)
Users are advised to upgrade to e107 version 2.3.7, which addresses this vulnerability by applying proper input sanitization and escaping techniques. Instructions for upgrading are available on the e107 GitHub Releases page.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 14, 2026CISA-ADP
Assessed Oct 29, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/e107inc/e107/commit/120bd4bdbe18c8690c60a007ad6716e52e6ee965 | [email protected] | Source CodeVendor |
| https://github.com/e107inc/e107/releases/tag/v2.3.7 | [email protected] | Release NotesVendor |
| https://github.com/e107inc/e107/security/advisories/GHSA-5f75-c25x-59wx | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-89 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| e107 | >= 2, <= 2.4 |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 29, 2026 | CVE Modified | CISA-ADP |
| Oct 14, 2026 | New CVE Received | [email protected] |