{"id":"CVE-2026-55572","published":"2026-10-14T18:17:37.863","lastModified":"2026-10-16T20:04:29.760","description":"e107 is a content management system (CMS). Prior to 2.3.7, the bundled alt_auth plugin's otherdb and e107db authentication backends interpolate the submitted login username directly into SQL in e107_plugins/alt_auth/otherdb_auth.php and e107_plugins/alt_auth/e107db_auth.php. The login() methods execute those strings with PDO::query() before effective sanitization, so an unauthenticated user can inject SQL when alt_auth is installed and either backend is configured with a live external database connection. The injection can expose or modify data available to the configured database account, and query failures can additionally disclose the generated query through the debug-message path. This issue is fixed in version 2.3.7.","cvssScore":10,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","cwes":["CWE-89"],"vendors":[],"products":[],"references":[{"url":"https://github.com/e107inc/e107/commit/120bd4bdbe18c8690c60a007ad6716e52e6ee965","tags":[]},{"url":"https://github.com/e107inc/e107/releases/tag/v2.3.7","tags":[]},{"url":"https://github.com/e107inc/e107/security/advisories/GHSA-5f75-c25x-59wx","tags":[]}],"exploitRefs":[{"url":"https://github.com/e107inc/e107/commit/120bd4bdbe18c8690c60a007ad6716e52e6ee965","tags":[]},{"url":"https://github.com/e107inc/e107/releases/tag/v2.3.7","tags":[]},{"url":"https://github.com/e107inc/e107/security/advisories/GHSA-5f75-c25x-59wx","tags":[]}],"hasPoc":true,"ai":{"summary":"The e107 CMS contains a SQL injection vulnerability in its alt_auth plugin where user input is directly interpolated into SQL queries without proper sanitization, allowing unauthenticated attackers to execute arbitrary SQL commands against external databases. This critical flaw can lead to data exposure or modification through the configured authentication backends.","exploitability":"Exploitation is straightforward for unauthenticated users who can trigger the alt_auth plugin with either otherdb or e107db backends configured with live database connections, requiring no additional authentication or complex setup.","blast_radius":"The vulnerability affects installations using the alt_auth plugin with external database connections, potentially exposing or modifying sensitive data accessible to the configured database account, with impact scaling based on database permissions.","remediation":"Upgrade to version 2.3.7 immediately to remediate this critical SQL injection vulnerability in the alt_auth plugin.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["sql-injection","cms","authentication","web"],"model":"garnet-coder","analyzedAt":"2026-10-15T08:46:14.881Z"}}