Multiple SQL injection vulnerabilities in e107

134.4k
3
8
12
3
More
3
5

Advisory ID:	HTB22602
Product:	e107 Website System
Vendor:	e107
Vulnerable Versions:	0.7.23 and probably prior
Tested Version:	0.7.23
Advisory Publication:	September 3, 2010 [without technical details]
Vendor Notification:	September 3, 2010
Public Disclosure:	September 17, 2010
Vulnerability Type:	SQL Injection [CWE-89]
Risk Level:	Medium

CVSSv2 Base Score:	6.5 (AV:N/AC:L/Au:S/C:P/I:P/A:P)
Solution Status:	Fixed by Vendor
Discovered and Provided:	High-Tech Bridge Security Research Lab
Advisory Details:
High-Tech Bridge SA Security Research Lab has discovered three SQL injection vulnerabilities in e107 which could lead to execution of arbitrary SQL commands in application`s database. 1) SQL injection vulnerabilities in e107 1.1 An input validation error exists in the URL in /e107_admin/wmessage.php. A remote attacker can send a specially crafted HTTP GET request to the vulnerable script and execute arbitrary SQL commands in application`s database. Successful exploitation may allow an attacker to read, modify, add or delete arbitrary data but requires "Welcome message" permissions. Exploitation example: http://host/e107_admin/wmessage.php?create.edit.999999%0Aunion%0Aselect%0A1, 2,user%28%29 1.2 The vulnerability exists due input validation error in the URL in /e107_plugins/forum/forum_admin.php. A remote attacker can send a specially crafted HTTP GET request to the vulnerable script and execute arbitrary SQL commands in application`s database. Successful exploitation may allow an attacker to read, modify, add or delete arbitrary data but requires privileges to manage forums. Exploitation example: http://host/e107_plugins/forum/forum_admin.php?create.edit.9999999%0Aunion%0 Aselect%0A1,2,user(),4,5,6,7,8,9,10,11,12,13,14 1.3 An input validation error exists in the URL in /e107_admin/download.php. A remote attacker can send a specially crafted HTTP GET request to the vulnerable script and execute arbitrary SQL commands in application`s database. Successful exploitation may allow an attacker to read, modify, add or delete arbitrary data in database but requires "Post download" permissions. Exploitation example: http://host/e107_admin/download.php?cat.edit.999999%0Aunion%0Aselect%0A1,2,3 ,4,5,6,7
How to Detect SQL Injection Vulnerabilities Website Security Test GDPR & PCI DSS Test Website CMS Security Test CSP & HTTP Headers Check WordPress & Drupal Scanning Try For Free Solution:
Vendor has issued a fix for vulnerabilities 1.1 and 1.2 in version 0.7.25. Vulnerability 1.3 was fixed in version 0.7.24.

References:
[1] High-Tech Bridge Advisory HTB22344 - https://www.immuniweb.com/advisory/HTB22602 - Cross-site request forgery (CSRF) in e107 [2] e107 - http://e107.org - e107 is an Advanced Content Publishing Solution for Website Pages, Documents, Menus and Links (Content Management System) powered by PHP and MySQL. [3] Common Weakness Enumeration (CWE) - http://cwe.mitre.org - targeted to developers and security practitioners, CWE is a formal list of software weakness types.

Related Security Advisories: HTB22344: Cross-site request forgery (CSRF) in e107

Previous Security Advisories with CWE-89:

HTB22580: Multiple Vulnerabilities in CompuCMS

HTB22571: Multiple vulnerabilities in TCMS

134.4k
3
8
12
3
More
3
5

Have additional information to submit?
Please feel free to send us any additional information related to this Advisory, such as vulnerable versions, additional exploitation details and conditions, patches and other relevant details.