Description

e107 is a content management system (CMS). Prior to 2.3.7, the bundled alt_auth plugin's otherdb and e107db authentication backends interpolate the submitted login username directly into SQL in e107_plugins/alt_auth/otherdb_auth.php and e107_plugins/alt_auth/e107db_auth.php. The login() methods execute those strings with PDO::query() before effective sanitization, so an unauthenticated user can inject SQL when alt_auth is installed and either backend is configured with a live external database connection. The injection can expose or modify data available to the configured database account, and query failures can additionally disclose the generated query through the debug-message path. This issue is fixed in version 2.3.7.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "10.0",
  "pubDate": "2026-10-14T18:17:37.863Z",
  "pubdate": "2026-10-14T18:17:37.863Z",
  "executiveSummary": "The e107 content management system contains a critical SQL injection vulnerability within its bundled alt_auth plugin, specifically affecting the otherdb and e107db authentication backends.\nThe vulnerability allows an unauthenticated attacker to inject malicious SQL commands into the authentication process due to improper sanitization of user-supplied input.\nSuccessful exploitation permits unauthorized access to the underlying database, potentially resulting in data modification, exfiltration, or complete database compromise.\nThe flaw affects versions prior to 2.3.7 and requires the alt_auth plugin to be installed and actively configured with an external database connection.\nBeyond data manipulation, the vulnerability facilitates information disclosure through debug-message paths, which may expose raw query structures and further aid attackers in refining their payloads.\nThe risk is high, as it bypasses standard authentication controls and exposes sensitive data repositories to unauthorized modification or theft.",
  "technicalDetails": "The root cause of this vulnerability lies in the insecure handling of the username parameter within the login() methods of the alt_auth plugin. Specifically, in files e107_plugins/alt_auth/otherdb_auth.php and e107_plugins/alt_auth/e107db_auth.php, the application interpolates user-provided input directly into SQL queries before execution.\nWhen a user attempts to log in using the 'otherdb' or 'e107db' authentication methods, the submitted username is concatenated into the SQL statement string. These strings are subsequently passed to PDO::query() for execution. Because the input is not sanitized or properly parameterized prior to this interaction, the database engine treats the input as executable SQL code rather than literal data.\nThe attack flow begins when an unauthenticated actor submits a crafted username payload to the login interface. By including SQL metacharacters (such as single quotes or comment markers), the attacker can terminate the intended query and append arbitrary malicious commands. When the backend processes this input via PDO::query(), the injected commands are executed with the privileges of the configured database account.\nThe impact of this injection is significant. An attacker can manipulate data within the connected database, extract sensitive records, or bypass authentication mechanisms entirely. Additionally, the application's error-handling mechanism presents a secondary risk: if the injected query results in a syntax error, the debug-message path may disclose the malformed query string. This information disclosure provides the attacker with insights into the database schema and structure, facilitating further reconnaissance and more targeted exploitation attempts.\nThis vulnerability is present in all e107 versions prior to 2.3.7. It is specifically localized to the alt_auth plugin components. Exploitation is contingent upon the plugin being enabled and the authentication backend being configured to communicate with an active external database instance.\nThe lack of prepared statements or robust input filtering is the critical failure point. By failing to separate command logic from user-supplied data, the application exposes its database layer to unauthorized manipulation from remote, unauthenticated network actors."
}