PHP Object Injection and SQL Injection in e107 by RipTech
CVE-2016-10753

8.8HIGH

Key Information:

Vendor

E107

Status
E107
Vendor
CVE Published:
24 May 2019

What is CVE-2016-10753?

The e107 version 2.1.2 is susceptible to a PHP Object Injection vulnerability that can lead to SQL injection attacks. This vulnerability arises when the application utilizes the unserialize function without applying HMAC verification, allowing attackers to craft malicious payloads that compromise the security of the database. As a result, unauthorized access to sensitive information could occur, making it crucial for users to update to secure versions and enhance their overall application security.

References

https://demo.ripstech.com/projects/e107_2.1.2
x_refsource_MISC
https://blog.ripstech.com/2016/e107-sql-injection-through...
x_refsource_MISC

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.