Vulnerability in E107
CVE-2006-4757
Multiple SQL injection vulnerabilities in the admin section in e107 0.7.5 allow remote authenticated administrative users to execute arbitrary SQL commands via the (1) linkopentype, (2) linkrender, (3) link_class, and (4) link_id parameters in (a) links.php; the (5) searchquery parameter in (b) users.php; and the (6) download_category_class parameter in (c) download.php. NOTE: an e107 developer has disputed the significance of the vulnerability, stating that "If your admins are injecting you, you might want to reconsider their access."
Published · last modified .
CVSS v2 metric
CVSS v2 base score 4.6 (Medium). Vector: AV:N/AC:H/Au:S/C:P/I:P/A:P. This CVE predates CVSS v3 and has no v3 score from NVD.
EPSS exploit prediction
EPSS: 0.009 (58.1th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 58th percentile — 58.1% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.009 · newest: 0.009 · change: 0.000
Affected products
- E107 — versions 0.6_10, 0.6_11, 0.6_12
References
- securityreason.com/securityalert/1569 (third-party-advisory)
- www.securityfocus.com/archive/1/445005/100/100/threaded (mailing-list)
- e107.org/e107_plugins/bugtrack/bugtrack.php