CyberRota Analysis
AI-GeneratedAn SQL injection vulnerability in e107 2.4.0 allows unauthenticated remote attackers to execute arbitrary SQL commands through the news item page ID parameter, which is improperly concatenated into a SQL WHERE clause. This critical flaw enables attackers to read, modify, or delete all database contents, including sensitive administrator credentials. Organizations using this version of e107 should prioritize immediate remediation to mitigate the risk of unauthorized access and data compromise.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
An SQL injection vulnerability in e107 2.4.0 allows unauthenticated remote attackers to execute arbitrary SQL via the news item page ID parameter. The parameter is concatenated without escaping into a SQL WHERE clause. An unauthenticated attacker can read, modify, or delete all database contents including administrator credentials.