Executive brief
e107 is an open-source content management system used to build websites and manage digital content. An attacker without credentials can inject malicious SQL commands through a web request to read, modify, or delete all database contents, including administrator credentials that control the entire site.
Technical details
The vulnerability is a SQL injection flaw in e107 2.4.0 affecting the news item page ID parameter. The parameter value is concatenated directly into a SQL WHERE clause without sanitization or parameterized query protection. An unauthenticated, remote attacker can craft a malicious request containing SQL metacharacters to execute arbitrary database commands. This allows complete database compromise including retrieval of sensitive data, modification of records, or deletion of content. Patches should use parameterized queries or proper input validation.
Affected products
- e107 e107 2.4.0
Timeline
- 2026-08-11: disclosed